Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-3965 - Nsc Plugin
The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Nsc
CVE-2023-3965
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3962 - Winters Plugin
The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Winters
CVE-2023-3962
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3933 - Your Journey Plugin
The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Your Journey
CVE-2023-3933
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5618 - Modern Footnotes Plugin
The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 1.4.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Modern Footnotes
CVE-2023-5618
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5615 - Skype Legacy Buttons Plugin
The Skype Legacy Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skype-status' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Skype Legacy Buttons
CVE-2023-5615
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5337 - Formforall Plugin
The Contact form Form For All plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Formforall
CVE-2023-5337
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5292 - Advanced Custom Fields Extended Plugin
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfe_form' shortcode in versions up to, and including, 0.8.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Advanced Custom Fields Extended
CVE-2023-5292
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5231 - Magic Action Box Plugin
The Magic Action Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.17.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Magic Action Box
CVE-2023-5231
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5109 - Wp Mailto Links Plugin
The WP Mailto Links – Protect Email Addresses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wpml_mailto' shortcode in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 3.1.3 and fully patched in version 3.1.4.
PLUGIN
Wp Mailto Links
CVE-2023-5109
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5086 - Copy Anything To Clipboard Plugin
The Copy Anything to Clipboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'copy' shortcode in versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Copy Anything To Clipboard
CVE-2023-5086
Risk Score
Threat Entry
Updated 2025-05-12
CVE-2023-5533 - Wpbot Plugin
The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.8.9 as well as 4.9.2. This makes it possible for unauthenticated attackers to perform some of those actions that were intended for higher privileged users.
PLUGIN
Wpbot
CVE-2023-5533
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5121 - Migration Backup Staging Plugin
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings (the backup path parameter) in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Migration Backup Staging
CVE-2023-5121
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5602 - Social Media Share Buttons Social Sharing Icons Plugin
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes it possible for unauthenticated attackers to invoke those actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Social Media Share Buttons Social Sharing Icons
CVE-2023-5602
Risk Score
Threat Entry
Updated 2025-05-12
CVE-2023-5534 - Wpbot Plugin
The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is due to missing or incorrect nonce validation on the corresponding functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Wpbot
CVE-2023-5534
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4999 - Horizontal Scrolling Announcement Plugin
The Horizontal scrolling announcement plugin for WordPress is vulnerable to SQL Injection via the plugin's [horizontal-scrolling] shortcode in versions up to, and including, 9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Horizontal Scrolling Announcement
CVE-2023-4999
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4386 - Essential Blocks Plugin
The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the get_posts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
PLUGIN
Essential Blocks
CVE-2023-4386
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5070 - Social Media Share Buttons Social Sharing Icons Plugin
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function. This can allow subscribers to export plugin settings that include social media authentication tokens and secrets as well as app passwords.
PLUGIN
Social Media Share Buttons Social Sharing Icons
CVE-2023-5070
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4961 - Popups Plugin
The Poptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'poptin-form' shortcode in versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Popups
CVE-2023-4961
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4926 - Bear Woocommerce Bulk Editor And Products Manager Professional Plugin
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulk_delete_products function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Bear Woocommerce Bulk Editor And Products Manager Professional
CVE-2023-4926
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4924 - Bear Woocommerce Bulk Editor And Products Manager Professional Plugin
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to missing capability checks on the woobe_bulkoperations_delete function. This makes it possible for authenticated attackers, with subscriber access or higher, to delete products.
PLUGIN
Bear Woocommerce Bulk Editor And Products Manager Professional
CVE-2023-4924
Risk Score