Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-03-18
CVE-2024-4094 - Simple Share Buttons Adder Plugin
The Simple Share Buttons Adder WordPress plugin before 8.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Simple Share Buttons Adder
CVE-2024-4094
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-5172 - Expert Invoice Plugin
The Expert Invoice WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Expert Invoice
CVE-2024-5172
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3276 - Foobox Image Lightbox Premium Plugin
The Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium WordPress plugin before 2.7.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Foobox Image Lightbox Premium
CVE-2024-3276
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5527 - Business Directory Plugin
The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file. This allows authenticated attackers, with author-level permissions and above, to embed untrusted input into CSV files exported by administrators, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
PLUGIN
Business Directory
CVE-2023-5527
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-5860 - Tickera Plugin
The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tc_dl_delete_tickets AJAX action in all versions up to, and including, 3.5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all tickets associated with events.
PLUGIN
Tickera
CVE-2024-5860
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-5541 - Ibtana Plugin
The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ibtana_visual_editor_register_ajax_json_endpont' function in all versions up to, and including, 1.2.3.3. This makes it possible for unauthenticated attackers to update option values for reCAPTCHA keys on the WordPress site. This can be leveraged to bypass reCAPTCHA on the site.
PLUGIN
Ibtana
CVE-2024-5541
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-1634 - Scheduling Plugin Online Booking
The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cbsb_disconnect_settings' function in all versions up to, and including, 3.5.10. This makes it possible for unauthenticated attackers to disconnect the plugin from the startbooking service and remove connection data.
PLUGIN
Scheduling Plugin Online Booking
CVE-2024-1634
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4375 - Master Slider Plugin
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_layer' shortcode in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on the 'css_id' user supplied attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Master Slider
CVE-2024-4375
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-0845 - Pdf Viewer For Elementor Plugin
The PDF Viewer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the render function in all versions up to, and including, 2.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Pdf Viewer For Elementor
CVE-2024-0845
Risk Score
Threat Entry
Updated 2025-05-13
CVE-2024-4305 - Post Grid Gutenberg Blocks And Wordpress Blog Plugin
The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.1.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Post Grid Gutenberg Blocks And Wordpress Blog
CVE-2024-4305
Risk Score
Threat Entry
Updated 2025-05-13
CVE-2024-3236 - Popup Builder Plugin
The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Popup Builder
CVE-2024-3236
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-5611 - Elementor Widgets Plugin
The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘label_years’ attribute within the Countdown widget in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Elementor Widgets
CVE-2024-5611
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4258 - Video Gallery Plugin
The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.13 via the settings parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
PLUGIN
Video Gallery
CVE-2024-4258
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4551 - Video Gallery Plugin
The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.13 via the display function. This makes it possible for authenticated attackers, with contributor access and higher, to include and execute arbitrary php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded…
PLUGIN
Video Gallery
CVE-2024-4551
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4095 - Jquery Collapse O Matic Plugin
The Collapse-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'expand' and 'expandsub' shortcode in all versions up to, and including, 1.8.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Jquery Collapse O Matic
CVE-2024-4095
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-5858 - Infographic And List Builder Ilist Plugin
The AI Infographic Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the qcld_openai_title_generate_desc AJAX action in all versions up to, and including, 4.7.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary post titles.
PLUGIN
Infographic And List Builder Ilist
CVE-2024-5858
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3105 - Insert Php Plugin
The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insert_php' shortcode. This is due to the plugin not restricting the usage of the functionality to high level authorized users. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server.
PLUGIN
Insert Php
CVE-2024-3105
Risk Score
Threat Entry
Updated 2025-05-09
CVE-2024-2695 - Shariff Wrapper Plugin
The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including, 4.6.13 due to insufficient input sanitization and output escaping on user supplied attributes such as 'borderradius' and 'timestamp'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Shariff Wrapper
CVE-2024-2695
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-1399 - Table Reservation Plugin
The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Table Reservation
CVE-2024-1399
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-6000 - Fooevents For Woocommerce Plugin
The FooEvents for WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability setting on the 'display_ticket_themes_page' function in versions up to, and including, 1.19.20. This makes it possible for authenticated attackers with contributor-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This was partially patched in 1.19.20, and fully patched in 1.19.21.
PLUGIN
Fooevents For Woocommerce
CVE-2024-6000
Risk Score