Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-04-23
CVE-2023-4390 - Before 3 Plugin
The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
PLUGIN
Before 3
CVE-2023-4390
Risk Score
Threat Entry
Updated 2025-04-22
CVE-2023-4251 - Before 3 Plugin
The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.
PLUGIN
Before 3
CVE-2023-4251
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5116 - Live Updates From Excel Plugin
The Live updates from Excel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ipushpull_page' shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Live Updates From Excel
CVE-2023-5116
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5099 - Html Filter And Csv File Search Plugin
The HTML filter and csv-file search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.7 via the 'src' attribute of the 'csvsearch' shortcode. This allows authenticated attackers, with contributor-level permissions and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
PLUGIN
Html Filter And Csv File Search
CVE-2023-5099
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5073 - Iframe Forms Plugin
The iframe forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iframe' shortcode in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Iframe Forms
CVE-2023-5073
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5114 - Idbbee Plugin
The idbbee plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'idbbee' shortcode in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Idbbee
CVE-2023-5114
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5464 - Jquery Accordion Slideshow Plugin
The Jquery accordion slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Jquery Accordion Slideshow
CVE-2023-5464
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5439 - Wp Photo Text Slider 50 Plugin
The Wp photo text slider 50 plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Wp Photo Text Slider 50
CVE-2023-5439
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5438 - Wp Image Slideshow Plugin
The wp image slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Wp Image Slideshow
CVE-2023-5438
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5437 - Wp Fade In Text News Plugin
The WP fade in text news plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Wp Fade In Text News
CVE-2023-5437
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5436 - Vertical Marquee Plugin
The Vertical marquee plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Vertical Marquee
CVE-2023-5436
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5435 - Up Down Image Slideshow Gallery Plugin
The Up down image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Up Down Image Slideshow Gallery
CVE-2023-5435
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5434 - Superb Slideshow Gallery Plugin
The Superb slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Superb Slideshow Gallery
CVE-2023-5434
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5433 - Message Ticker Plugin
The Message ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Message Ticker
CVE-2023-5433
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5431 - Left Right Image Slideshow Gallery Plugin
The Left right image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Left Right Image Slideshow Gallery
CVE-2023-5431
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5430 - Jquery News Ticker Plugin
The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Jquery News Ticker
CVE-2023-5430
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5429 - Information Reel Plugin
The Information Reel plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Information Reel
CVE-2023-5429
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5428 - Image Vertical Reel Scroll Slideshow Plugin
The Image vertical reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Image Vertical Reel Scroll Slideshow
CVE-2023-5428
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5412 - Image Horizontal Reel Scroll Slideshow Plugin
The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Image Horizontal Reel Scroll Slideshow
CVE-2023-5412
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5843 - Ads By Datafeedr Com Plugin
The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1.3 via the 'dfads_ajax_load_ads' function. This allows unauthenticated attackers to execute code on the server. The parameters of the callable function are limited, they cannot be specified arbitrarily.
PLUGIN
Ads By Datafeedr Com
CVE-2023-5843
Risk Score