Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-04-09
CVE-2024-1325 - Woomotiv Plugin
The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.3. This is due to missing or incorrect nonce validation on the 'ajax_cancel_review' function. This makes it possible for unauthenticated attackers to reset the site's review count via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Woomotiv
CVE-2024-1325
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-1119 - Order Tip For Woocommerce Plugin
The Order Tip for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_tips_to_csv() function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to export the plugin's order fees.
PLUGIN
Order Tip For Woocommerce
CVE-2024-1119
Risk Score
Threat Entry
Updated 2025-02-05
CVE-2024-2538 - Permalink Manager Lite Plugin
The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_permalink' function in all versions up to, and including, 2.4.3.1. This makes it possible for authenticated attackers, with author access and above, to modify the permalinks of arbitrary posts.
PLUGIN
Permalink Manager Lite
CVE-2024-2538
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2474 - Standout Color Boxes And Buttons Plugin
The Standout Color Boxes and Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'color-button' shortcode in all versions up to, and including, 0.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Standout Color Boxes And Buttons
CVE-2024-2474
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2024-0856 - Appointment Booking Calendar Plugin
The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying.
PLUGIN
Appointment Booking Calendar
CVE-2024-0856
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2024-1983 - Simple Ajax Chat Plugin
The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users.
PLUGIN
Simple Ajax Chat
CVE-2024-1983
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2124 - Translate WordPress and go Multilingual – Weglot Plugin
The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and including, 4.2.5 due to insufficient input sanitization and output escaping on user supplied attributes such as 'className'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Translate WordPress and go Multilingual – Weglot
CVE-2024-2124
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2024-0337 - Travelpayouts Plugin
The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
PLUGIN
Travelpayouts
CVE-2024-0337
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2023-7246 - System Dashboard Plugin
The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks
PLUGIN
System Dashboard
CVE-2023-7246
Risk Score
Threat Entry
Updated 2025-01-27
CVE-2024-2255 - Essential Blocks Plugin
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 4.5.2 due to insufficient input sanitization and output escaping on user supplied attributes such as listStyle. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Essential Blocks
CVE-2024-2255
Risk Score
Threat Entry
Updated 2025-02-04
CVE-2024-1799 - Gamipress Plugin
The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to SQL Injection via the 'achievement_types' attribute of the gamipress_earnings shortcode in all versions up to, and including, 6.8.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the…
PLUGIN
Gamipress
CVE-2024-1799
Risk Score
Threat Entry
Updated 2025-03-12
CVE-2024-2460 - Gamipress Plugin
The GamiPress – Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gamipress_button' shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Gamipress
CVE-2024-2460
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2384 - Woocommerce Pos Plugin
The WooCommerce POS plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.4.11. This is due to the plugin not properly verifying the authentication and authorization of the current user This makes it possible for authenticated attackers, with customer-level access and above, to view potentially sensitive information about other users by leveraging their order id
PLUGIN
Woocommerce Pos
CVE-2024-2384
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-1787 - Contests By Rewards Fuel Plugin
The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_rewards_fuel_api_key' parameter in all versions up to, and including, 2.0.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Contests By Rewards Fuel
CVE-2024-1787
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2387 - Advanced Form Integration Plugin
The Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms plugin for WordPress is vulnerable to SQL Injection via the ‘integration_id’ parameter in all versions up to, and including, 1.82.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries and subsequently inject arbitrary web scripts in pages that execute if they can successfully trick a user into…
PLUGIN
Advanced Form Integration
CVE-2024-2387
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-1785 - Contests By Rewards Fuel Plugin
The Contests by Rewards Fuel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.62. This is due to missing or incorrect nonce validation on the ajax_handler() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site's user with the edit_posts capability into performing an action such as clicking on a link.
PLUGIN
Contests By Rewards Fuel
CVE-2024-1785
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-1995 - Smart Custom Fields Plugin
The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() function in all versions up to, and including, 4.2.2. This makes it possible for authenticated attackers, with subscrber-level access and above, to retrieve post content that is password protected and/or private.
PLUGIN
Smart Custom Fields
CVE-2024-1995
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2024-1401 - Profile Box Shortcode And Widget Plugin
The Profile Box Shortcode And Widget WordPress plugin before 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Profile Box Shortcode And Widget
CVE-2024-1401
Risk Score
Threat Entry
Updated 2026-01-28
CVE-2024-29142 - Better Search Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebberZone Better Search – Relevant search results for WordPress allows Stored XSS.This issue affects Better Search – Relevant search results for WordPress: from n/a through 3.3.0.
PLUGIN
Better Search
CVE-2024-29142
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2024-0858 - Innovs Hr Plugin
The Innovs HR WordPress plugin through 1.0.3.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees.
PLUGIN
Innovs Hr
CVE-2024-0858
Risk Score