Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-51532 - Icegram Engage Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building allows Stored XSS.This issue affects Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: from n/a through 3.1.19.
PLUGIN
Icegram Engage
CVE-2023-51532
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-7069 - Advanced Iframe Plugin
The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2023.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-24870 is likely a duplicate of this issue.
PLUGIN
Advanced Iframe
CVE-2023-7069
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-22159 - Wolf Wordpress Posts Bulk Editor And Products Manager Professional Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional allows Reflected XSS.This issue affects WOLF – WordPress Posts Bulk Editor and Manager Professional: from n/a through 1.0.8.
PLUGIN
Wolf Wordpress Posts Bulk Editor And Products Manager Professional
CVE-2024-22159
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-22150 - Powerfolio Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PWR Plugins Portfolio & Image Gallery for WordPress | PowerFolio allows Stored XSS.This issue affects Portfolio & Image Gallery for WordPress | PowerFolio: from n/a through 3.1.
PLUGIN
Powerfolio
CVE-2024-22150
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-23508 - Pdf Poster Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster – PDF Embedder Plugin for WordPress allows Reflected XSS.This issue affects PDF Poster – PDF Embedder Plugin for WordPress: from n/a through 2.1.17.
PLUGIN
Pdf Poster
CVE-2024-23508
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-22304 - Freshmail For Wordpress Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Borbis Media FreshMail For WordPress.This issue affects FreshMail For WordPress: from n/a through 2.3.2.
PLUGIN
Freshmail For Wordpress
CVE-2024-22304
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-22305 - Kali Forms Plugin
Authorization Bypass Through User-Controlled Key vulnerability in ali Forms Contact Form builder with drag & drop for WordPress – Kali Forms.This issue affects Contact Form builder with drag & drop for WordPress – Kali Forms: from n/a through 2.3.36.
PLUGIN
Kali Forms
CVE-2024-22305
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-0836 - Review Schema Plugin
The WordPress Review & Structure Data Schema Plugin – Review Schema plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtrs_review_edit() function in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary reviews.
PLUGIN
Review Schema
CVE-2024-0836
Risk Score
Threat Entry
Updated 2025-05-29
CVE-2024-1069 - Database For Contact Form 7 Wpforms Elementor Forms Plugin
The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Database For Contact Form 7 Wpforms Elementor Forms
CVE-2024-1069
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2439 - Userpro Plugin
The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Userpro
CVE-2023-2439
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-23825 - Tablepress Plugin
TablePress is a table plugin for Wordpress. For importing tables, TablePress makes external HTTP requests based on a URL that is provided by the user. That user input is filtered insufficiently, which makes it is possible to send requests to unintended network locations and receive responses. On sites in a cloud environment like AWS, an attacker can potentially make GET requests to the instance's metadata REST API. If the instance's configuration is insecure, this can lead to the exposure of internal data, including credentials. This vulnerability is fixed in 2.2.5.
PLUGIN
Tablepress
CVE-2024-23825
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-1061 - Html5 Video Player Plugin
The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_view' function.
PLUGIN
Html5 Video Player
CVE-2024-1061
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-7225 - Mappress Plugin
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the width and height parameters in all versions up to, and including, 2.88.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Mappress
CVE-2023-7225
Risk Score
Threat Entry
Updated 2025-06-17
CVE-2023-7074 - Wp Social Bookmark Menu Plugin
The WP SOCIAL BOOKMARK MENU WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
PLUGIN
Wp Social Bookmark Menu
CVE-2023-7074
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2023-6946 - Autotitle Plugin
The Autotitle for WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
PLUGIN
Autotitle
CVE-2023-6946
Risk Score
Threat Entry
Updated 2025-05-29
CVE-2023-6391 - Custom User Css Plugin
The Custom User CSS WordPress plugin through 0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
PLUGIN
Custom User Css
CVE-2023-6391
Risk Score
Threat Entry
Updated 2025-06-20
CVE-2023-6390 - Wordpress Users Plugin
The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
PLUGIN
Wordpress Users
CVE-2023-6390
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2023-7204 - Wp Staging Plugin
The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which provides
PLUGIN
Wp Staging
CVE-2023-7204
Risk Score
Threat Entry
Updated 2026-02-20
CVE-2023-6279 - Woostify Sites Library Plugin
The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name
PLUGIN
Woostify Sites Library
CVE-2023-6279
Risk Score
Threat Entry
Updated 2025-06-02
CVE-2023-7200 - Before 4 Plugin
The EventON WordPress plugin before 4.4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 4
CVE-2023-7200
Risk Score