Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-05-15
CVE-2024-1204 - Meta Box Plugin
The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts.
PLUGIN
Meta Box
CVE-2024-1204
Risk Score
Threat Entry
Updated 2025-05-09
CVE-2023-6067 - Wp User Profile Avatar Plugin
The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Wp User Profile Avatar
CVE-2023-6067
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3662 - WPZOOM Social Feed Widget & Block Plugin
The WPZOOM Social Feed Widget & Block plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpzoom_instagram_clear_data() function in all versions up to, and including, 2.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all Instagram images installed on the site.
PLUGIN
WPZOOM Social Feed Widget & Block
CVE-2024-3662
Risk Score
Threat Entry
Updated 2025-06-17
CVE-2023-6494 - Wpc Smart Quick View For Woocommerce Plugin
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Wpc Smart Quick View For Woocommerce
CVE-2023-6494
Risk Score
Threat Entry
Updated 2025-05-12
CVE-2024-2583 - Shortcodes Ultimate Plugin
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible for users with the contributor role to conduct Stored XSS attacks.
PLUGIN
Shortcodes Ultimate
CVE-2024-2583
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3027 - Smart Slider 3 Plugin
The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all versions up to, and including, 3.5.1.22. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files, including SVG files, which can be used to conduct stored cross-site scripting attacks.
PLUGIN
Smart Slider 3
CVE-2024-3027
Risk Score
Threat Entry
Updated 2025-02-27
CVE-2024-1957 - Givewp Plugin
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Givewp
CVE-2024-1957
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-31235 - WordPress Comments Import & Export Plugin
Cross-Site Request Forgery (CSRF) vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.5.
PLUGIN
WordPress Comments Import & Export
CVE-2024-31235
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3211 - Shopping Cart & eCommerce Store Plugin
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to SQL Injection via the 'productid' attribute of the ec_addtocart shortcode in all versions up to, and including, 5.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Shopping Cart & eCommerce Store
CVE-2024-3211
Risk Score
Threat Entry
Updated 2025-02-27
CVE-2024-3054 - Migration Backup Staging Plugin
WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deserialization of untrusted input at the wpvividstg_get_custom_exclude_path_free action. This is due to the plugin not providing sufficient path validation on the tree_node[node][id] parameter. This makes it possible for authenticated attackers, with admin-level access and above, to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects. No POP chain is present in the vulnerable plugin. If a POP chain is present via an…
PLUGIN
Migration Backup Staging
CVE-2024-3054
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2801 - Shopkeeper Extender Plugin
The Shopkeeper Extender plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'image_slide' shortcode in all versions up to, and including, 3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Shopkeeper Extender
CVE-2024-2801
Risk Score
Threat Entry
Updated 2025-04-08
CVE-2024-2137 - All In One Addons For Elementor Plugin
The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple pricing widgets (e.g. Pricing Single, Pricing Icon, Pricing Tab) in all versions up to, and including, 2.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
All In One Addons For Elementor
CVE-2024-2137
Risk Score
Threat Entry
Updated 2025-05-09
CVE-2024-0881 - Post Carousel Plugin
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts
PLUGIN
Post Carousel
CVE-2024-0881
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-31285 - WordPress Tooltips Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Tooltip WordPress Tooltips allows Stored XSS.This issue affects WordPress Tooltips: from n/a through 9.5.3.
PLUGIN
WordPress Tooltips
CVE-2024-31285
Risk Score
Threat Entry
Updated 2025-01-22
CVE-2024-3344 - Otter Blocks Plugin
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Otter Blocks
CVE-2024-3344
Risk Score
Threat Entry
Updated 2025-01-22
CVE-2024-3343 - Otter Blocks Plugin
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Otter Blocks
CVE-2024-3343
Risk Score
Threat Entry
Updated 2025-04-08
CVE-2024-3285 - Slider Gallery And Carousel Plugin
The Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'metaslider' shortcode in all versions up to, and including, 3.70.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Slider Gallery And Carousel
CVE-2024-3285
Risk Score
Threat Entry
Updated 2025-01-21
CVE-2024-2966 - Element Pack Plugin
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.6 via the element_pack_ajax_search function. This makes it possible for unauthenticated attackers to extract sensitive data including password protected post details.
PLUGIN
Element Pack
CVE-2024-2966
Risk Score
Threat Entry
Updated 2025-05-09
CVE-2023-6257 - Inline Related Posts Plugin
The Inline Related Posts WordPress plugin before 3.6.0 is missing authorization in an AJAX action to ensure that users are allowed to see the content of the posts displayed, allowing any authenticated user, such as subscriber to retrieve the content of password protected posts
PLUGIN
Inline Related Posts
CVE-2023-6257
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6811 - Language Translate Widget for WordPress – ConveyThis Plugin
The Language Translate Widget for WordPress – ConveyThis plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key’ parameter in all versions up to, and including, 223 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Language Translate Widget for WordPress – ConveyThis
CVE-2023-6811
Risk Score