Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-2330 - Before 1 Plugin
The Caldera Forms Google Sheets Connector WordPress plugin before 1.3 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
PLUGIN
Before 1
CVE-2023-2330
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2329 - Before 1 Plugin
The WooCommerce Google Sheet Connector WordPress plugin before 1.3.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
PLUGIN
Before 1
CVE-2023-2329
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-1893 - Login Configurator Plugin
The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-site scripting vulnerability targeting site administrators.
PLUGIN
Login Configurator
CVE-2023-1893
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2579 - Inventorypress Plugin
The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Inventorypress
CVE-2023-2579
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2143 - Enable Svg Webp Ico Upload Plugin
The Enable SVG, WebP & ICO Upload WordPress plugin through 1.0.3 does not sanitize SVG file contents, leading to a Cross-Site Scripting vulnerability.
PLUGIN
Enable Svg Webp Ico Upload
CVE-2023-2143
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0439 - Nex Forms Plugin
The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By default only SuperAdmins (in multisite) / admins (in single site) can create forms, however there is a settings allowing them to give lower roles access to such feature.
PLUGIN
Nex Forms
CVE-2023-0439
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-23646 - Album Gallery Plugin
Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Album Gallery – WordPress Gallery plugin
PLUGIN
Album Gallery
CVE-2023-23646
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-22672 - Vslider Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin
PLUGIN
Vslider
CVE-2023-22672
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2082 - Buy Me A Coffee Plugin
The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.6 due to insufficient sanitization and escaping on the 'text value set via the bmc_post_reception action. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to inject arbitrary web scripts into pages that execute whenever a victim accesses a page with the injected scripts.
PLUGIN
Buy Me A Coffee
CVE-2023-2082
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3342 - User Registration Plugin
The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'ur_upload_profile_pic' function in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with subscriber-level capabilities or above to upload arbitrary files on the affected site's server which may make remote code execution possible. This was partially patched in version 3.0.2 and fully patched in version 3.0.2.1.
PLUGIN
User Registration
CVE-2023-3342
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3343 - User Registration Plugin
The User Registration plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.0.1 via deserialization of untrusted input from the 'profile-pic-url' parameter. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
PLUGIN
User Registration
CVE-2023-3343
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4427 - Revenue Plugin
The Vuukle Comments, Reactions, Share Bar, Revenue plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.31. This is due to missing or incorrect nonce validation in the /admin/partials/free-comments-for-wordpress-vuukle-admin-display.php file. This makes it possible for unauthenticated attackers to edit the plugins settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Revenue
CVE-2021-4427
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4426 - Absolute Reviews Plugin
The Absolute Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8. This is due to missing or incorrect nonce validation on the metabox_review_save() function. This makes it possible for unauthenticated attackers to save meta tags via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Absolute Reviews
CVE-2021-4426
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4425 - Defender Security Plugin
The Defender Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.6. This is due to missing or incorrect nonce validation on the verify_otp_login_time() function. This makes it possible for unauthenticated attackers to verify a one time login via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Defender Security
CVE-2021-4425
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4424 - Slider Hero Plugin
The Slider Hero plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.2.0. This is due to missing or incorrect nonce validation on the qc_slider_hero_duplicate() function. This makes it possible for unauthenticated attackers to duplicate slides via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Slider Hero
CVE-2021-4424
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4423 - Rays Grid Plugin
The RAYS Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.2. This is due to missing or incorrect nonce validation on the rsgd_insert_update() function. This makes it possible for unauthenticated attackers to update post fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Rays Grid
CVE-2021-4423
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4422 - Post Smtp Mailer Plugin
The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due to missing or incorrect nonce validation on the handleCsvExport() function. This makes it possible for unauthenticated attackers to trigger a CSV export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Post Smtp Mailer
CVE-2021-4422
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4421 - Advanced Popups Plugin
The Advanced Popups plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the metabox_popup_save() function. This makes it possible for unauthenticated attackers to save meta tags via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Advanced Popups
CVE-2021-4421
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4420 - Sell Media Plugin
The Sell Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.5. This is due to missing or incorrect nonce validation on the sell_media_process() function. This makes it possible for unauthenticated attackers to sell media paypal orders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Sell Media
CVE-2021-4420
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4419 - Wp Backgrounds Lite Plugin
The WP-Backgrounds Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the ino_save_data() function. This makes it possible for unauthenticated attackers to save meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Wp Backgrounds Lite
CVE-2021-4419
Risk Score