Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-3452 - Canto Plugin
The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.
PLUGIN
Canto
CVE-2023-3452
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4283 - Embedpress Plugin
The EmbedPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embedpress_calendar' shortcode in versions up to, and including, 3.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Embedpress
CVE-2023-4283
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4282 - Embedpress Plugin
The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'admin_post_remove' and 'remove_private_data' functions in versions up to, and including, 3.8.2. This makes it possible for authenticated attackers with subscriber privileges or above, to delete plugin settings.
PLUGIN
Embedpress
CVE-2023-4282
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4277 - Realia Plugin
The Realia plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.0. This is due to missing nonce validation on the 'process_change_profile_form' function. This makes it possible for unauthenticated attackers to change user email via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Realia
CVE-2023-4277
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4276 - Absolute Privacy Plugin
The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the 'abpr_profileShortcode' function. This makes it possible for unauthenticated attackers to change user email and password via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Absolute Privacy
CVE-2023-4276
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4243 - Full Customer Plugin
The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to execute code by installing plugins from arbitrary remote locations including non-repository sources onto the site, granted they are packaged as a valid WordPress plugin.
PLUGIN
Full Customer
CVE-2023-4243
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4242 - Full Customer Plugin
The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration as disclosed by the WordPress health check.
PLUGIN
Full Customer
CVE-2023-4242
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4239 - Real Estate Manager Plugin
The Real Estate Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7.1 due to insufficient restriction on the 'rem_save_profile_front' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.
PLUGIN
Real Estate Manager
CVE-2023-4239
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-24413 - Wordpress Vertical Image Slider Plugin
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution WordPress vertical image slider plugin
PLUGIN
Wordpress Vertical Image Slider
CVE-2023-24413
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-32503 - Gtmetrix Plugin
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin
PLUGIN
Gtmetrix
CVE-2023-32503
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3365 - Multiparcels Shipping For Woocommerce Plugin
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.14 does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment
PLUGIN
Multiparcels Shipping For Woocommerce
CVE-2023-3365
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3492 - Wp Shopping Pages Plugin
The WP Shopping Pages WordPress plugin through 1.14 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
PLUGIN
Wp Shopping Pages
CVE-2023-3492
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2023-3671 - Multiparcels Shipping For Woocommerce Plugin
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape various parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Multiparcels Shipping For Woocommerce
CVE-2023-3671
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2023-3524 - Before 2 Plugin
The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
PLUGIN
Before 2
CVE-2023-3524
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3575 - Quiz And Survey Master Plugin
The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Quiz And Survey Master
CVE-2023-3575
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3650 - Before 3 Plugin
The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
PLUGIN
Before 3
CVE-2023-3650
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2843 - Multiparcels Shipping For Woocommerce Plugin
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.15 does not properly sanitize and escape a parameter before using it in an SQL statement, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
PLUGIN
Multiparcels Shipping For Woocommerce
CVE-2023-2843
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24916 - Before 1 Plugin
The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action.
PLUGIN
Before 1
CVE-2021-24916
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0604 - Wp Food Manager Plugin
The WP Food Manager WordPress plugin before 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Wp Food Manager
CVE-2023-0604
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4142 - Wp Ultimate Csv Importer Plugin
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means remote code execution is still possible for site administrators, use the plugin with caution.
PLUGIN
Wp Ultimate Csv Importer
CVE-2023-4142
Risk Score