Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-01-08
CVE-2024-2110 - Events Manager Plugin
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.7.1. This is due to missing or incorrect nonce validation on several actions. This makes it possible for unauthenticated attackers to modify booking statuses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Events Manager
CVE-2024-2110
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-29765 - Aparat for WordPress Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alireza Sedghi Aparat for WordPress allows Stored XSS.This issue affects Aparat for WordPress: from n/a through 2.2.0.
PLUGIN
Aparat for WordPress
CVE-2024-29765
Risk Score
Threat Entry
Updated 2025-03-05
CVE-2024-29763 - Wordpress Meta Data And Taxonomies Filter Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Reflected XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.
PLUGIN
Wordpress Meta Data And Taxonomies Filter
CVE-2024-29763
Risk Score
Threat Entry
Updated 2025-05-13
CVE-2024-29804 - Fancy Comments Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Heateor Fancy Comments WordPress allows Stored XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.14.
PLUGIN
Fancy Comments
CVE-2024-29804
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-29771 - Vulnerability In Softlab Dracula Dark Mode The Revolutionary Dark Mode Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoftLab Dracula Dark Mode - The Revolutionary Dark Mode Plugin For WordPress allows Stored XSS.This issue affects Dracula Dark Mode - The Revolutionary Dark Mode Plugin For WordPress: from n/a through 1.0.8.
PLUGIN
Vulnerability In Softlab Dracula Dark Mode The Revolutionary Dark Mode
CVE-2024-29771
Risk Score
Threat Entry
Updated 2025-03-05
CVE-2024-29932 - Wordpress Meta Data And Taxonomies Filter Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Stored XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.2.
PLUGIN
Wordpress Meta Data And Taxonomies Filter
CVE-2024-29932
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2956 - Simple Ajax Chat – Add a Fast, Secure Chat Box Plugin
The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 20231101 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Simple Ajax Chat – Add a Fast, Secure Chat Box
CVE-2024-2956
Risk Score
Threat Entry
Updated 2026-01-08
CVE-2024-30201 - Wp Smart Import Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WordPress Importer allows Reflected XSS.This issue affects WordPress Importer: from n/a through 1.0.4.
PLUGIN
Wp Smart Import
CVE-2024-30201
Risk Score
Threat Entry
Updated 2025-03-12
CVE-2024-2954 - Action Network Plugin
The Action Network plugin for WordPress is vulnerable to SQL Injection via the 'bulk-action' parameter in version 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Action Network
CVE-2024-2954
Risk Score
Threat Entry
Updated 2025-03-12
CVE-2024-2781 - Elementor Pro Plugin
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the video_html_tag attribute in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Elementor Pro
CVE-2024-2781
Risk Score
Threat Entry
Updated 2025-03-12
CVE-2024-2121 - Elementor Pro Plugin
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Carousel widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Elementor Pro
CVE-2024-2121
Risk Score
Threat Entry
Updated 2025-01-28
CVE-2024-2120 - Website Builder Plugin
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Navigation widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Website Builder
CVE-2024-2120
Risk Score
Threat Entry
Updated 2025-03-05
CVE-2024-29906 - Wordpress Meta Data And Taxonomies Filter Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Stored XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.2.
PLUGIN
Wordpress Meta Data And Taxonomies Filter
CVE-2024-29906
Risk Score
Threat Entry
Updated 2025-03-12
CVE-2024-1521 - Elementor Pro Plugin
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an SVGZ file uploaded via the Form widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability is only exploitable on web servers running NGINX. It is not exploitable on web servers running Apache HTTP Server.
PLUGIN
Elementor Pro
CVE-2024-1521
Risk Score
Threat Entry
Updated 2025-03-12
CVE-2024-1364 - Elementor Pro Plugin
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget's custom_id in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Elementor Pro
CVE-2024-1364
Risk Score
Threat Entry
Updated 2025-01-28
CVE-2024-2210 - The Plus Addons For Elementor Plugin
The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Team Member Listing widget. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
PLUGIN
The Plus Addons For Elementor
CVE-2024-2210
Risk Score
Threat Entry
Updated 2025-01-28
CVE-2024-2203 - The Plus Addons For Elementor Plugin
The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Clients widget. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
PLUGIN
The Plus Addons For Elementor
CVE-2024-2203
Risk Score
Threat Entry
Updated 2025-01-28
CVE-2024-2139 - Master Addons Plugin
The Master Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Table widget in all versions up to, and including, 2.0.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Master Addons
CVE-2024-2139
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2303 - Easy Textillate Plugin
The Easy Textillate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'textillate' shortcode in all versions up to, and including, 2.01 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Easy Textillate
CVE-2024-2303
Risk Score
Threat Entry
Updated 2025-04-01
CVE-2024-2170 - Vk All In One Expansion Unit Plugin
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the child page index widget in all versions up to, and including, 9.96.0.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'className.' This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Vk All In One Expansion Unit
CVE-2024-2170
Risk Score