Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-49170 - Captainform Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captainform Forms by CaptainForm – Form Builder for WordPress allows Reflected XSS.This issue affects Forms by CaptainForm – Form Builder for WordPress: from n/a through 2.5.3.
PLUGIN
Captainform
CVE-2023-49170
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6553 - Backup Migration Plugin
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.
PLUGIN
Backup Migration
CVE-2023-6553
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6827 - Essential Real Estate Plugin
The Essential Real Estate plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'ajaxUploadFonts' function in versions up to, and including, 4.3.5. This makes it possible for authenticated attackers with subscriber-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Essential Real Estate
CVE-2023-6827
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6826 - E2pdf Plugin
The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'import_action' function in versions up to, and including, 1.20.25. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin, to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
E2pdf
CVE-2023-6826
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-49841 - Simple List Building Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FancyThemes Optin Forms – Simple List Building Plugin for WordPress allows Stored XSS.This issue affects Optin Forms – Simple List Building Plugin for WordPress: from n/a through 1.3.3.
PLUGIN
Simple List Building
CVE-2023-49841
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-49827 - Soledad Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme allows Reflected XSS.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a through 8.4.1.
PLUGIN
Soledad
CVE-2023-49827
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-49833 - Spectra Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra – WordPress Gutenberg Blocks allows Stored XSS.This issue affects Spectra – WordPress Gutenberg Blocks: from n/a through 2.7.9.
PLUGIN
Spectra
CVE-2023-49833
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-49168 - Better Messages Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPlus Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss allows Stored XSS.This issue affects Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss: from n/a through 2.4.0.
PLUGIN
Better Messages
CVE-2023-49168
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-50371 - Most Wanted Analytics Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress allows Stored XSS.This issue affects Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress: from n/a through 8.0.6.
PLUGIN
Most Wanted Analytics
CVE-2023-50371
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6035 - Before 2 Plugin
The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
PLUGIN
Before 2
CVE-2023-6035
Risk Score
Threat Entry
Updated 2025-05-27
CVE-2023-5907 - File Manager Plugin
The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites files.
PLUGIN
File Manager
CVE-2023-5907
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5750 - Before 3 Plugin
The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape a parameter before outputting it back in the page containing a specific content, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 3
CVE-2023-5750
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5749 - Before 3 Plugin
The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 3
CVE-2023-5749
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5955 - Contact Form Email Plugin
The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Contact Form Email
CVE-2023-5955
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5940 - Wp Not Login Hide Plugin
The WP Not Login Hide (WPNLH) WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Wp Not Login Hide
CVE-2023-5940
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5757 - Wp Crowdfunding Plugin
The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Wp Crowdfunding
CVE-2023-5757
Risk Score
Threat Entry
Updated 2025-02-20
CVE-2023-6120 - Welcart E Commerce Plugin
The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the upload_certificate_file function. This makes it possible for administrators to upload .pem or .crt files to arbitrary locations on the server.
PLUGIN
Welcart E Commerce
CVE-2023-6120
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5756 - Digital Publications By Supsystic Plugin
The Digital Publications by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.6. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthenticated attackers to execute AJAX actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Digital Publications By Supsystic
CVE-2023-5756
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-47548 - Integrate Google Drive Plugin
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SoftLab Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site.This issue affects Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site: from n/a through 1.3.2.
PLUGIN
Integrate Google Drive
CVE-2023-47548
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-48325 - Landing Page Builder Plugin
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages.This issue affects Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages: from n/a through 1.5.1.5.
PLUGIN
Landing Page Builder
CVE-2023-48325
Risk Score