Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-02-25
CVE-2024-0431 - Gestpay For Woocommerce Plugin
The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to missing or incorrect nonce validation on the 'ajax_set_default_card' function. This makes it possible for unauthenticated attackers to set the default card token for a user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Gestpay For Woocommerce
CVE-2024-0431
Risk Score
Threat Entry
Updated 2025-02-07
CVE-2023-6922 - Under Construction Maintenance Mode Plugin
The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.6 via the 'acx_csma_subscribe_ajax' function. This can allow authenticated attackers to extract sensitive data such as names and email addresses of subscribed visitors.
PLUGIN
Under Construction Maintenance Mode
CVE-2023-6922
Risk Score
Threat Entry
Updated 2025-01-08
CVE-2024-1943 - Yuki Plugin
The Yuki theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 1.3.14. This is due to missing or incorrect nonce validation on the reset_customizer_options() function. This makes it possible for unauthenticated attackers to reset the themes settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Yuki
CVE-2024-1943
Risk Score
Threat Entry
Updated 2025-01-16
CVE-2024-1568 - Seraphinite Accelerator Plugin
The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 via the OnAdminApi_HtmlCheck function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
PLUGIN
Seraphinite Accelerator
CVE-2024-1568
Risk Score
Threat Entry
Updated 2025-01-16
CVE-2024-1388 - Yuki Plugin
The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_customizer_options() function in all versions up to, and including, 1.3.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to reset the theme's settings.
PLUGIN
Yuki
CVE-2024-1388
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1912 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxUpdateFolderPosition function. This makes it possible for unauthenticated attackers to update the folder position of categories as well as update the metadata of other taxonomies via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Categorify
CVE-2024-1912
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1910 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxClearCategory function. This makes it possible for unauthenticated attackers to clear categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Categorify
CVE-2024-1910
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1909 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxRenameCategory function. This makes it possible for unauthenticated attackers to rename categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Categorify
CVE-2024-1909
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1907 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxDeleteCategory function. This makes it possible for unauthenticated attackers to delete categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Categorify
CVE-2024-1907
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1906 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxAddCategory function. This makes it possible for unauthenticated attackers to add categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Categorify
CVE-2024-1906
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1653 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxUpdateFolderPosition in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the folder position of categories as well as update the metadata of other taxonomies.
PLUGIN
Categorify
CVE-2024-1653
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1652 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxClearCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear categories.
PLUGIN
Categorify
CVE-2024-1652
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1650 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxRenameCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to rename categories.
PLUGIN
Categorify
CVE-2024-1650
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1649 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxDeleteCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete categories.
PLUGIN
Categorify
CVE-2024-1649
Risk Score
Threat Entry
Updated 2025-05-01
CVE-2023-7165 - Before 2 Plugin
The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files.
PLUGIN
Before 2
CVE-2023-7165
Risk Score
Threat Entry
Updated 2025-05-01
CVE-2023-6585 - Wp Jobsearch Plugin
The WP JobSearch WordPress plugin before 2.3.4 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server
PLUGIN
Wp Jobsearch
CVE-2023-6585
Risk Score
Threat Entry
Updated 2025-05-01
CVE-2023-6584 - Wp Jobsearch Plugin
The WP JobSearch WordPress plugin before 2.3.4 does not prevent attackers from logging-in as any users with the only knowledge of that user's email address.
PLUGIN
Wp Jobsearch
CVE-2023-6584
Risk Score
Threat Entry
Updated 2025-05-01
CVE-2024-1106 - Shariff Wrapper Plugin
The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Shariff Wrapper
CVE-2024-1106
Risk Score
Threat Entry
Updated 2025-04-08
CVE-2023-7203 - Smart Forms Plugin
The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to call them and perform unauthorised actions such as deleting entries. The plugin also lacks CSRF checks in some places which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as deleting entries.
PLUGIN
Smart Forms
CVE-2023-7203
Risk Score
Threat Entry
Updated 2025-05-01
CVE-2023-7202 - Fatal Error Notify Plugin
The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any authenticated users, such as subscriber to call it and spam the admin email address with error messages. The issue is also exploitable via CSRF
PLUGIN
Fatal Error Notify
CVE-2023-7202
Risk Score