Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2024-1051 - List Category Posts Plugin
The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.89.6 due to insufficient input sanitization and output escaping on user supplied attributes like 'title_tag'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
List Category Posts
CVE-2024-1051
Risk Score
Threat Entry
Updated 2025-01-30
CVE-2024-0367 - Unlimited Elements For Elementor Plugin
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link field of an installed widget (e.g., 'Button Link') in all versions up to, and including, 1.5.96 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Unlimited Elements For Elementor
CVE-2024-0367
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-30444 - WordPress Page Builder – Zion Builder Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zionbuilder.Io WordPress Page Builder – Zion Builder allows Stored XSS.This issue affects WordPress Page Builder – Zion Builder: from n/a through 3.6.9.
PLUGIN
WordPress Page Builder – Zion Builder
CVE-2024-30444
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-30492 - Import Export WordPress Users Plugin
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.2.
PLUGIN
Import Export WordPress Users
CVE-2024-30492
Risk Score
Threat Entry
Updated 2025-02-27
CVE-2024-30478 - Bulletin Plugin
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bulletin WordPress Announcement & Notification Banner Plugin – Bulletin.This issue affects WordPress Announcement & Notification Banner Plugin – Bulletin: from n/a through 3.8.5.
PLUGIN
Bulletin
CVE-2024-30478
Risk Score
Threat Entry
Updated 2025-03-10
CVE-2024-30457 - Wordpress Meta Data And Taxonomies Filter Plugin
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.1.
PLUGIN
Wordpress Meta Data And Taxonomies Filter
CVE-2024-30457
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2848 - Responsive Plugin
The Responsive theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_footer_text_callback function in all versions up to, and including, 5.0.2. This makes it possible for unauthenticated attackers to inject arbitrary HTML content into the site's footer.
PLUGIN
Responsive
CVE-2024-2848
Risk Score
Threat Entry
Updated 2025-03-13
CVE-2024-3061 - Husky Products Filter Professional For Woocommerce Plugin
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.5.2 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
PLUGIN
Husky Products Filter Professional For Woocommerce
CVE-2024-3061
Risk Score
Threat Entry
Updated 2025-02-13
CVE-2024-2411 - Masterstudy Lms Plugin
The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
PLUGIN
Masterstudy Lms
CVE-2024-2411
Risk Score
Threat Entry
Updated 2025-02-13
CVE-2024-2409 - Masterstudy Lms Plugin
The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the _register_user() function called by the 'wp_ajax_nopriv_stm_lms_register' AJAX action. This makes it possible for unauthenticated attackers to register a user with administrator-level privileges when MasterStudy LMS Pro is installed and the LMS Forms Editor add-on is enabled.
PLUGIN
Masterstudy Lms
CVE-2024-2409
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2250 - 140+ Widgets | Best Addons For Elementor – FREE Plugin
The 130+ Widgets | Best Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
140+ Widgets | Best Addons For Elementor – FREE
CVE-2024-2250
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-2969 - Wp Eggdrop Plugin
The WP-Eggdrop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the wpegg_updateOptions() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Wp Eggdrop
CVE-2024-2969
Risk Score
Threat Entry
Updated 2025-05-19
CVE-2024-2968 - Wp Eggdrop Plugin
The WP-Eggdrop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Wp Eggdrop
CVE-2024-2968
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2970 - News Wall Plugin
The News Wall plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the nwap_newslist_page() function. This makes it possible for unauthenticated attackers to update the plugin's settings and modify news lists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
News Wall
CVE-2024-2970
Risk Score
Threat Entry
Updated 2025-03-06
CVE-2024-2964 - Pocket News Generator Plugin
The Pocket News Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.0. This is due to missing or incorrect nonce validation on the option_page() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Pocket News Generator
CVE-2024-2964
Risk Score
Threat Entry
Updated 2025-03-06
CVE-2024-2963 - Pocket News Generator Plugin
The Pocket News Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings such as "Consumer Key" and "Access Token" in all versions up to, and including, 0.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Pocket News Generator
CVE-2024-2963
Risk Score
Threat Entry
Updated 2025-03-06
CVE-2024-2280 - Better Elementor Addons Plugin
The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget link URL values in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Better Elementor Addons
CVE-2024-2280
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2116 - Christmas Greetings Plugin
The Christmas Greetings plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the code parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Christmas Greetings
CVE-2024-2116
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2476 - OceanWP Plugin
The OceanWP theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_theme_panel_pane function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose sensitive information such as system/environment data and API keys.
PLUGIN
OceanWP
CVE-2024-2476
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-1872 - Button Plugin
The Button plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.28 via deserialization of untrusted input in the button_shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
PLUGIN
Button
CVE-2024-1872
Risk Score