Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-0551 - Rest Api To Miniprogram Plugin
The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments
PLUGIN
Rest Api To Miniprogram
CVE-2023-0551
Risk Score
Threat Entry
Updated 2026-01-14
CVE-2023-0274 - Before 2 Plugin
The URL Params WordPress plugin before 2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 2
CVE-2023-0274
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2254 - Ko Fi Button Plugin
The Ko-fi Button WordPress plugin before 1.3.3 does not properly some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup), and we consider it a low risk.
PLUGIN
Ko Fi Button
CVE-2023-2254
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2225 - Seo Alert Plugin
The SEO ALert WordPress plugin through 1.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Seo Alert
CVE-2023-2225
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2271 - Tiempo Plugin
The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when deleting its shortcode, which could allow attackers to make logged in admins delete arbitrary shortcode via a CSRF attack
PLUGIN
Tiempo
CVE-2023-2271
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0058 - Tiempo Plugin
The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
PLUGIN
Tiempo
CVE-2023-0058
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3958 - Wp Remote Users Sync Plugin
The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to, and including, 1.2.12. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This was partially patched in version 1.2.12 and fully patched in version 1.2.13.
PLUGIN
Wp Remote Users Sync
CVE-2023-3958
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4374 - Wp Remote Users Sync Plugin
The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'refresh_logs_async' functions in versions up to, and including, 1.2.11. This makes it possible for authenticated attackers with subscriber privileges or above, to view logs.
PLUGIN
Wp Remote Users Sync
CVE-2023-4374
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-30498 - Vimeotheque Plugin
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodeFlavors Vimeotheque: Vimeo WordPress Plugin
PLUGIN
Vimeotheque
CVE-2023-30498
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2916 - Infinitewp Client Plugin
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.
PLUGIN
Infinitewp Client
CVE-2023-2916
Risk Score
Threat Entry
Updated 2025-02-11
CVE-2023-4308 - User Submitted Posts Plugin
The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in versions up to, and including, 20230809 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
User Submitted Posts
CVE-2023-4308
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2023-3721 - Wp Email Plugin
The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Wp Email
CVE-2023-3721
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3645 - Contact Form Builder By Bit Form Plugin
The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Contact Form Builder By Bit Form
CVE-2023-3645
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3435 - User Activity Log Plugin
The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks.
PLUGIN
User Activity Log
CVE-2023-3435
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2803 - Ultimate Addons For Contact Form 7 Plugin
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Ultimate Addons For Contact Form 7
CVE-2023-2803
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3328 - Custom Field For Wp Job Manager Plugin
The Custom Field For WP Job Manager WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Custom Field For Wp Job Manager
CVE-2023-3328
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2802 - Ultimate Addons For Contact Form 7 Plugin
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Ultimate Addons For Contact Form 7
CVE-2023-2802
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2606 - Wp Brutal Ai Plugin
The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Wp Brutal Ai
CVE-2023-2606
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2023-3601 - Simple Author Box Plugin
The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbitrary user information disclosure to users with a role as low as Contributor.
PLUGIN
Simple Author Box
CVE-2023-3601
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4293 - Premium Packages Sell Digital Products Securely Plugin
The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to insufficient restriction on the 'wpdmpp_update_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'profile[role]' parameter during a profile update.
PLUGIN
Premium Packages Sell Digital Products Securely
CVE-2023-4293
Risk Score