Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-04-23
CVE-2023-4643 - Enable Media Replace Plugin
The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog
PLUGIN
Enable Media Replace
CVE-2023-4643
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4290 - Wp Matterport Shortcode Plugin
The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin
PLUGIN
Wp Matterport Shortcode
CVE-2023-4290
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4646 - Simple Posts Ticker Plugin
The Simple Posts Ticker WordPress plugin before 1.1.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Simple Posts Ticker
CVE-2023-4646
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4289 - Wp Matterport Shortcode Plugin
The WP Matterport Shortcode WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Wp Matterport Shortcode
CVE-2023-4289
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3746 - Before 1 Plugin
The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks
PLUGIN
Before 1
CVE-2023-3746
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4388 - Before 2 Plugin
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 2
CVE-2023-4388
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3154 - Wordpress Gallery Plugin
The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to PHAR Deserialization due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server.
PLUGIN
Wordpress Gallery
CVE-2023-3154
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3155 - Wordpress Gallery Plugin
The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server.
PLUGIN
Wordpress Gallery
CVE-2023-3155
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3279 - Wordpress Gallery Plugin
The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks
PLUGIN
Wordpress Gallery
CVE-2023-3279
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3707 - Before 1 Plugin
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the content of arbitrary post (such as draft and private) via an IDOR vector. Password protected posts are not affected by this issue.
PLUGIN
Before 1
CVE-2023-3707
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3706 - Before 1 Plugin
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary post (such as draft and private) via an IDOR vector
PLUGIN
Before 1
CVE-2023-3706
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-45831 - Google Amp Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Pixelative, Mohsin Rafique AMP WP – Google AMP For WordPress plugin
PLUGIN
Google Amp
CVE-2023-45831
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-4827 - File Manager Pro Plugin
The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell.
PLUGIN
File Manager Pro
CVE-2023-4827
Risk Score
Threat Entry
Updated 2025-05-02
CVE-2023-4620 - Booking Calendar Plugin
The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators
PLUGIN
Booking Calendar
CVE-2023-4620
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3392 - Before 3 Plugin
The Read More & Accordion WordPress plugin before 3.2.7 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
PLUGIN
Before 3
CVE-2023-3392
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-1259 - Hotjar Plugin
The Hotjar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the hotjar_site_id in versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Hotjar
CVE-2023-1259
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4995 - Embed Calendly Plugin
The Embed Calendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'calendly' shortcode in versions up to, and including, 3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Embed Calendly
CVE-2023-4995
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-38000 - Gutenberg Plugin
Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin
PLUGIN
Gutenberg
CVE-2023-38000
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-41131 - Spotify Play Button Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin
PLUGIN
Spotify Play Button
CVE-2023-41131
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5470 - Etsy Shop Plugin
The Etsy Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etsy-shop' shortcode in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Etsy Shop
CVE-2023-5470
Risk Score