Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-06-18
CVE-2023-6532 - Wp Blogs Planetarium Plugin
The WP Blogs' Planetarium WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PLUGIN
Wp Blogs Planetarium
CVE-2023-6532
Risk Score
Threat Entry
Updated 2025-06-03
CVE-2023-6528 - Slider Revolution Plugin
The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution.
PLUGIN
Slider Revolution
CVE-2023-6528
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6140 - Essential Real Estate Plugin
The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution.
PLUGIN
Essential Real Estate
CVE-2023-6140
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6750 - Before 2 Plugin
The Clone WordPress plugin before 2.4.3 uses buffer files to store in-progress backup informations, which is stored at a publicly accessible, statically defined file path.
PLUGIN
Before 2
CVE-2023-6750
Risk Score
Threat Entry
Updated 2025-06-18
CVE-2023-6505 - Before 1 Plugin
The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files.
PLUGIN
Before 1
CVE-2023-6505
Risk Score
Threat Entry
Updated 2025-04-17
CVE-2023-6383 - Debug Log Manager Plugin
The Debug Log Manager WordPress plugin before 2.3.0 contains a Directory listing vulnerability was discovered, which allows you to download the debug log without authorization and gain access to sensitive data
PLUGIN
Debug Log Manager
CVE-2023-6383
Risk Score
Threat Entry
Updated 2025-06-18
CVE-2023-6627 - Before 9 Plugin
The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.28 does not properly protect most of its REST API routes, which attackers can abuse to store malicious HTML/Javascript on the site.
PLUGIN
Before 9
CVE-2023-6627
Risk Score
Threat Entry
Updated 2025-06-18
CVE-2023-6555 - Email Subscription Popup Plugin
The Email Subscription Popup WordPress plugin before 1.2.20 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Email Subscription Popup
CVE-2023-6555
Risk Score
Threat Entry
Updated 2025-06-18
CVE-2023-6529 - Wp Vr Plugin
The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities.
PLUGIN
Wp Vr
CVE-2023-6529
Risk Score
Threat Entry
Updated 2025-06-17
CVE-2023-6161 - Wp Crowdfunding Plugin
The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Wp Crowdfunding
CVE-2023-6161
Risk Score
Threat Entry
Updated 2025-06-18
CVE-2023-6141 - Essential Real Estate Plugin
The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks.
PLUGIN
Essential Real Estate
CVE-2023-6141
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2023-5235 - Ovic Responsive Wpbakery Plugin
The Ovic Responsive WPBakery WordPress plugin before 1.2.9 does not limit which options can be updated via some of its AJAX actions, which may allow attackers with a subscriber+ account to update blog options, such as 'users_can_register' and 'default_role'. It also unserializes user input in the process, which may lead to Object Injection attacks.
PLUGIN
Ovic Responsive Wpbakery
CVE-2023-5235
Risk Score
Threat Entry
Updated 2025-06-18
CVE-2023-5957 - Ni Purchase Order Po For Woocommerce Plugin
The Ni Purchase Order(PO) For WooCommerce WordPress plugin through 1.2.1 does not validate logo and signature image files uploaded in the settings, allowing high privileged user to upload arbitrary files to the web server, triggering an RCE vulnerability by uploading a web shell.
PLUGIN
Ni Purchase Order Po For Woocommerce
CVE-2023-5957
Risk Score
Threat Entry
Updated 2025-06-03
CVE-2023-6139 - Essential Real Estate Plugin
The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks.
PLUGIN
Essential Real Estate
CVE-2023-6139
Risk Score
Threat Entry
Updated 2025-06-18
CVE-2023-5911 - Wp Custom Cursors Wordpress Cursor Plugin
The WP Custom Cursors | WordPress Cursor Plugin WordPress plugin through 3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Wp Custom Cursors Wordpress Cursor
CVE-2023-5911
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6801 - Rss Aggregator By Feedzy Plugin
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Rss Aggregator By Feedzy
CVE-2023-6801
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6798 - Rss Aggregator By Feedzy Plugin
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check when updating settings in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with author-level access or above to change the plugin's settings including proxy settings, which are also exposed to authors.
PLUGIN
Rss Aggregator By Feedzy
CVE-2023-6798
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-52124 - Responsive Tabs Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC WP Tabs – Responsive Tabs Plugin for WordPress allows Stored XSS.This issue affects WP Tabs – Responsive Tabs Plugin for WordPress: from n/a through 2.2.0.
PLUGIN
Responsive Tabs
CVE-2023-52124
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-52119 - Icegram Engage Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building.This issue affects Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: from n/a through 3.1.18.
PLUGIN
Icegram Engage
CVE-2023-52119
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-51538 - Awesome Support Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin.This issue affects Awesome Support – WordPress HelpDesk & Support Plugin: from n/a through 6.1.5.
PLUGIN
Awesome Support
CVE-2023-51538
Risk Score