Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-04-10
CVE-2024-34434 - Wordpress Meta Data And Taxonomies Filter Plugin
Incorrect Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Code Inclusion, Functionality Misuse.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.2.
PLUGIN
Wordpress Meta Data And Taxonomies Filter
CVE-2024-34434
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-47683 - WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin
Improper Privilege Management vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Privilege Escalation.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.6.
PLUGIN
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)
CVE-2023-47683
Risk Score
Threat Entry
Updated 2025-05-30
CVE-2024-3580 - Popup4phone Plugin
The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Popup4phone
CVE-2024-3580
Risk Score
Threat Entry
Updated 2025-05-30
CVE-2024-3231 - Popup4phone Plugin
The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
PLUGIN
Popup4phone
CVE-2024-3231
Risk Score
Threat Entry
Updated 2025-06-30
CVE-2024-2697 - Socialdriver Framework Plugin
The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
PLUGIN
Socialdriver Framework
CVE-2024-2697
Risk Score
Threat Entry
Updated 2025-05-21
CVE-2024-2744 - Nextgen Gallery Plugin
The NextGEN Gallery WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Nextgen Gallery
CVE-2024-2744
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3551 - Penci Soledad Data Migrator Plugin
The Penci Soledad Data Migrator plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.0 via the 'data' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This is limited to just PHP files.
PLUGIN
Penci Soledad Data Migrator
CVE-2024-3551
Risk Score
Threat Entry
Updated 2025-01-29
CVE-2024-3134 - Master Addons Plugin
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title_html_tag attribute in all versions up to, and including, 2.0.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Master Addons
CVE-2024-3134
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4204 - Bulk Posts Editing For Wordpress Plugin
The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to missing or incorrect nonce validation on the plugin's AJAX actions.. This makes it possible for unauthenticated attackers to create and duplicate posts, retrieve post content, and modify post taxonomy among other things via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Bulk Posts Editing For Wordpress
CVE-2024-4204
Risk Score
Threat Entry
Updated 2025-06-27
CVE-2024-3609 - Reviewx Plugin
The ReviewX – Multi-criteria Rating & Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the reviewx_remove_guest_image function in all versions up to, and including, 1.6.27. This makes it possible for authenticated attackers, with subscriber access and above, to delete attachments.
PLUGIN
Reviewx
CVE-2024-3609
Risk Score
Threat Entry
Updated 2025-01-29
CVE-2024-2619 - Elementor Header Footer Builder Plugin
The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary HTML in pages that will be shown whenever a user accesses an injected page.
PLUGIN
Elementor Header Footer Builder
CVE-2024-2619
Risk Score
Threat Entry
Updated 2025-01-30
CVE-2024-4580 - Master Addons Plugin
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 2.0.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Master Addons
CVE-2024-4580
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4838 - Convertplus Plugin
The ConvertPlus plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.26 via deserialization of untrusted input from the 'settings_encoded' attribute of the 'smile_modal' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
PLUGIN
Convertplus
CVE-2024-4838
Risk Score
Threat Entry
Updated 2025-01-30
CVE-2024-4634 - Elementor Header Footer Builder Plugin
The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hfe_svg_mime_types’ function in versions up to, and including, 1.6.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Elementor Header Footer Builder
CVE-2024-4634
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4617 - Seo By Rank Math Plugin
The Rank Math SEO with AI Best SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in versions up to, and including, 1.0.218 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Seo By Rank Math
CVE-2024-4617
Risk Score
Threat Entry
Updated 2025-03-20
CVE-2024-4400 - Post And Page Builder Plugin
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plguin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 1.26.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Post And Page Builder
CVE-2024-4400
Risk Score
Threat Entry
Updated 2025-01-30
CVE-2024-4385 - Envo Extra Plugin
The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 1.8.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Envo Extra
CVE-2024-4385
Risk Score
Threat Entry
Updated 2025-01-28
CVE-2024-4288 - Simply Schedule Appointments Plugin
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in versions up to, and including, 1.6.7.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Simply Schedule Appointments
CVE-2024-4288
Risk Score
Threat Entry
Updated 2025-01-22
CVE-2024-4352 - Tutor Lms Plugin
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the 'get_calendar_materials' function. The plugin is also vulnerable to SQL Injection via the ‘year’ parameter of that function due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to append additional SQL queries into already existing queries that can be used to…
PLUGIN
Tutor Lms
CVE-2024-4352
Risk Score
Threat Entry
Updated 2025-01-22
CVE-2024-4351 - Tutor Lms Plugin
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the 'authenticate' function in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to gain control of an existing administrator account.
PLUGIN
Tutor Lms
CVE-2024-4351
Risk Score