Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-4141 - Wp Ultimate Csv Importer Plugin
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to create a PHP file and execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means php file creation is still allowed for site administrators, use the plugin with caution.
PLUGIN
Wp Ultimate Csv Importer
CVE-2023-4141
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4140 - Wp Ultimate Csv Importer Plugin
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction on the 'get_header_values' function. This makes it possible for authenticated attackers, with minimal permissions such as an author, if the administrator previously grants access in the plugin settings, to modify their user role by supplying the 'wp_capabilities->cus1' parameter.
PLUGIN
Wp Ultimate Csv Importer
CVE-2023-4140
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4139 - Wp Ultimate Csv Importer Plugin
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and including, 7.9.8. This makes it possible for unauthenticated attackers to list and view exported files.
PLUGIN
Wp Ultimate Csv Importer
CVE-2023-4139
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4067 - Bus Ticket Booking With Seat Reservation Plugin
The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_date' and 'tab_date_r' parameters in versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Bus Ticket Booking With Seat Reservation
CVE-2023-4067
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3508 - Woocommerce Pre Orders Plugin
The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when processing its tab actions, which could allow attackers to make logged in admins email pre-orders customer, change the released date, mark all pre-orders of a specific product as complete or cancel via CSRF attacks
PLUGIN
Woocommerce Pre Orders
CVE-2023-3508
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3507 - Woocommerce Pre Orders Plugin
The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admins cancel arbitrary pre-orders via a CSRF attack
PLUGIN
Woocommerce Pre Orders
CVE-2023-3507
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2023-3345 - Lms By Masteriyo Plugin
The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students
PLUGIN
Lms By Masteriyo
CVE-2023-3345
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3292 - Grid Kit Premium Plugin
The grid-kit-premium WordPress plugin before 2.2.0 does not escape some parameters as well as generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Grid Kit Premium
CVE-2023-3292
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3134 - Before 1 Plugin
The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks.
PLUGIN
Before 1
CVE-2023-3134
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0602 - Twittee Text Tweet Plugin
The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin's administrative page, which allows reflected XSS attacks targeting administrators to happen.
PLUGIN
Twittee Text Tweet
CVE-2023-0602
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3130 - Short Url Plugin
The Short URL WordPress plugin before 1.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Short Url
CVE-2023-3130
Risk Score
Threat Entry
Updated 2025-04-03
CVE-2023-3977 - Ultimate Posts Widget Plugin
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Ultimate Posts Widget
CVE-2023-3977
Risk Score
Threat Entry
Updated 2025-04-03
CVE-2023-0958 - Ultimate Posts Widget Plugin
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.
PLUGIN
Ultimate Posts Widget
CVE-2023-0958
Risk Score
Threat Entry
Updated 2025-02-19
CVE-2023-37977 - Wpfunnels Plugin
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFunnels Team Drag & Drop Sales Funnel Builder for WordPress – WPFunnels plugin
PLUGIN
Wpfunnels
CVE-2023-37977
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3957 - Acf Photo Gallery Field Plugin
The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apg_profile_update' function in versions up to, and including, 1.9. This makes it possible for authenticated attackers, with subscriber-level permissions or above, to update the user metas arbitrarily. The meta value can only be a string.
PLUGIN
Acf Photo Gallery Field
CVE-2023-3957
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3956 - Instawp Connect Plugin
The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missing capability check on the 'events_receiver' function in versions up to, and including, 0.0.9.18. This makes it possible for unauthenticated attackers to add, modify or delete post and taxonomy, install, activate or deactivate plugin, change customizer settings, add or modify or delete user including administrator user.
PLUGIN
Instawp Connect
CVE-2023-3956
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3947 - Video Conferencing With Zoom Plugin
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This makes it possible for unauthenticated attackers to decrypt and view the meeting id and password.
PLUGIN
Video Conferencing With Zoom
CVE-2023-3947
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-36503 - Maxbuttons Plugin
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Max Foundry WordPress Button Plugin MaxButtons plugin
PLUGIN
Maxbuttons
CVE-2023-36503
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2761 - User Activity Log Plugin
The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.
PLUGIN
User Activity Log
CVE-2023-2761
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2309 - Wpforo Forum Plugin
The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnerability.
PLUGIN
Wpforo Forum
CVE-2023-2309
Risk Score