Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2024-4185 - Customer Email Verification For Woocommerce Plugin
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification and Authentication Bypass in all versions up to, and including, 2.7.4 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification, and if both the "Login the user automatically after the account is verified" and "Verify account for current users" options are checked, then it potentially makes it possible for attackers to bypass authentication for other users.
PLUGIN
Customer Email Verification For Woocommerce
CVE-2024-4185
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3072 - Acf Front End Editor Plugin
The ACF Front End Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_texts() function in all versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary post title, content, and ACF data.
PLUGIN
Acf Front End Editor
CVE-2024-3072
Risk Score
Threat Entry
Updated 2025-06-05
CVE-2024-1895 - Event Monster Plugin
The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.4 via deserialization via shortcode of untrusted input from a custom meta value. This makes it possible for authenticated attackers, with contributor access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary…
PLUGIN
Event Monster
CVE-2024-1895
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-1371 - Leadconnector Plugin
The LeadConnector plugin for WordPress is vulnerable to unauthorized modification & loss of data due to a missing capability check on the lc_public_api_proxy() function in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to delete arbitrary posts.
PLUGIN
Leadconnector
CVE-2024-1371
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-0216 - Google Doc Embedder Plugin
The Google Doc Embedder plugin for WordPress is vulnerable to Server Side Request Forgery via the 'gview' shortcode in versions up to, and including, 2.6.4. This can allow authenticated attackers with contributor-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
PLUGIN
Google Doc Embedder
CVE-2024-0216
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-2505 - Enabling Unauthorized Users To Modify Critical Gamipress Plugin
The GamiPress WordPress plugin before 6.8.9's access control mechanism fails to properly restrict access to its settings, permitting Authors to manipulate requests and extend access to lower privileged users, like Subscribers, despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical GamiPress WordPress plugin before 6.8.9 configurations.
PLUGIN
Enabling Unauthorized Users To Modify Critical Gamipress
CVE-2024-2505
Risk Score
Threat Entry
Updated 2025-04-08
CVE-2024-1905 - Smart Forms Plugin
The Smart Forms WordPress plugin before 2.6.96 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Smart Forms
CVE-2024-1905
Risk Score
Threat Entry
Updated 2025-02-07
CVE-2024-3309 - Qi Addons For Elementor Plugin
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget's attributes in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Qi Addons For Elementor
CVE-2024-3309
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3342 - Timetable And Event Schedule By Motopress Plugin
The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to SQL Injection via the 'events' attribute of the 'mp-timetable' shortcode in all versions up to, and including, 2.4.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Timetable And Event Schedule By Motopress
CVE-2024-3342
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3034 - Backupwordpress Plugin
The BackUpWordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.13 via the hmbkp_directory_browse parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to traverse directories outside of the context in which the plugin should allow.
PLUGIN
Backupwordpress
CVE-2024-3034
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2838 - Wpc Composite Products For Woocommerce Plugin
The WPC Composite Products for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wooco_components[0][name]' parameter in all versions up to, and including, 7.2.7 due to insufficient input sanitization and output escaping and missing authorization on the ajax_save_components function. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wpc Composite Products For Woocommerce
CVE-2024-2838
Risk Score
Threat Entry
Updated 2025-03-06
CVE-2024-2258 - Form Maker Plugin
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name autofilled into forms in all versions up to, and including, 1.15.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Form Maker
CVE-2024-2258
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-3076 - Mm Email2image Plugin
The MM-email2image WordPress plugin through 0.2.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
PLUGIN
Mm Email2image
CVE-2024-3076
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-33696 - WordPress Ad Widget Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet XPRESS WordPress Ad Widget allows Stored XSS.This issue affects WordPress Ad Widget: from n/a through 2.20.0.
PLUGIN
WordPress Ad Widget
CVE-2024-33696
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3682 - WP STAGING WordPress Backup Plugin – Migration Backup Restore
The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions up to, and including, 5.4.3, respectively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extract sensitive data from a log file, including system information and (in the Pro version) license keys. Successful exploitation requires an administrator to have used the 'Contact Us' functionality along with the "Enable this option to automatically submit the log files." option.
PLUGIN
WP STAGING WordPress Backup Plugin – Migration Backup Restore
CVE-2024-3682
Risk Score
Threat Entry
Updated 2025-02-07
CVE-2024-3962 - Product Addons Fields For Woocommerce Plugin
The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppom_upload_file function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Successful exploitation requires the PPOM Pro plugin to be installed along with a WooCommerce product that contains a file upload field to retrieve the correct nonce.
PLUGIN
Product Addons Fields For Woocommerce
CVE-2024-3962
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-1789 - Wp Smtp Plugin
The WP SMTP plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in versions 1.2 to 1.2.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Wp Smtp
CVE-2024-1789
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-3890 - Happy Addons For Elementor Plugin
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Calendly widget in all versions up to, and including, 3.10.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Happy Addons For Elementor
CVE-2024-3890
Risk Score
Threat Entry
Updated 2025-06-05
CVE-2024-3678 - Blog2social Plugin
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2. This makes it possible for unauthenticated attackers to view limited information from password protected posts.
PLUGIN
Blog2social
CVE-2024-3678
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2920 - WP-Members Membership Plugin
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 due to the plugin uploading user supplied files to a publicly accessible directory in wp-content without any restrictions. This makes it possible for unauthenticated attackers to view files uploaded by other users which may contain sensitive information.
PLUGIN
WP-Members Membership Plugin
CVE-2024-2920
Risk Score