Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-2517 - Metform Elementor Contact Form Builder Plugin
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on the permalink_setup function. This makes it possible for unauthenticated attackers to change the permalink structure via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. While nonce verification is implemented, verification only takes place when a nonce is provided.
PLUGIN
Metform Elementor Contact Form Builder
CVE-2023-2517
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2869 - Wp Members Plugin
The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the do_field_reorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorder form elements on login forms.
PLUGIN
Wp Members
CVE-2023-2869
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2562 - Gallery Metabox Plugin
The Gallery Metabox for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the refresh_metabox function in versions up to, and including, 1.5. This makes it possible for subscriber-level attackers to obtain a list of images attached to a post.
PLUGIN
Gallery Metabox
CVE-2023-2562
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2561 - Gallery Metabox Plugin
The Gallery Metabox for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gallery_remove function in versions up to, and including, 1.5. This makes it possible for subscriber-level attackers to modify galleries attached to posts and pages with this plugin.
PLUGIN
Gallery Metabox
CVE-2023-2561
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4417 - Custom Form Builder Plugin
The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.13.4. This is due to missing or incorrect nonce validation on the listen_for_saving_export_schedule() function. This makes it possible for unauthenticated attackers to export form submissions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Custom Form Builder
CVE-2021-4417
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4416 - Wp Mpdf Plugin
The wp-mpdf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.1. This is due to missing or incorrect nonce validation on the mpdf_admin_savepost() function. This makes it possible for unauthenticated attackers to save post data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Wp Mpdf
CVE-2021-4416
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4415 - Sunshine Photo Cart Plugin
The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshine_products_quicksave_post() function. This makes it possible for unauthenticated attackers to save custom post data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Sunshine Photo Cart
CVE-2021-4415
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4414 - Abandoned Cart Lite For Woocommerce Plugin
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.5. This is due to missing or incorrect nonce validation on the wcal_preview_emails() function. This makes it possible for unauthenticated attackers to generate email preview templates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Abandoned Cart Lite For Woocommerce
CVE-2021-4414
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4413 - Process Steps Template Designer Plugin
The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to save field icons via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Process Steps Template Designer
CVE-2021-4413
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4412 - Wp Prayer Plugin
The WP Prayer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5. This is due to missing or incorrect nonce validation on the save() and export() functions. This makes it possible for unauthenticated attackers to save plugin settings and trigger a data export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Wp Prayer
CVE-2021-4412
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4411 - Wp Easy Pay Plugin
The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the wpep_download_transaction_in_excel() function. This makes it possible for unauthenticated attackers to trigger a transactions download via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Wp Easy Pay
CVE-2021-4411
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4410 - Qtranslate Slug Plugin
The Qtranslate Slug plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.18. This is due to missing or incorrect nonce validation on the save_postdata() function. This makes it possible for unauthenticated attackers to save post data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Qtranslate Slug
CVE-2021-4410
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4409 - Woocommerce Etsy Integration Plugin
The WooCommerce Etsy Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the etcpf_delete_feed() function. This makes it possible for unauthenticated attackers to delete an export feed via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Woocommerce Etsy Integration
CVE-2021-4409
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4408 - Dw Question Answer Plugin
The DW Question & Answer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.8. This is due to missing or incorrect nonce validation on the update_answer() function. This makes it possible for unauthenticated attackers to update answers to questions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Dw Question Answer
CVE-2021-4408
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4407 - Custom Banners Plugin
The Custom Banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.2 This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated attackers to save custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Custom Banners
CVE-2021-4407
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-25706 - Better Robots Txt Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Pagup WordPress Robots.Txt optimization plugin
PLUGIN
Better Robots Txt
CVE-2023-25706
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-34029 - Disable Wordpress Update Notifications And Auto Update Email Notifications Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications plugin
PLUGIN
Disable Wordpress Update Notifications And Auto Update Email Notifications
CVE-2023-34029
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-34185 - Wordpress Nextgen Galleryview Plugin
Cross-Site Request Forgery (CSRF) vulnerability in John Brien WordPress NextGen GalleryView plugin
PLUGIN
Wordpress Nextgen Galleryview
CVE-2023-34185
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-37391 - Wordpress Mobile Pack Plugin
Cross-Site Request Forgery (CSRF) vulnerability in WPMobilePack.Com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps plugin
PLUGIN
Wordpress Mobile Pack
CVE-2023-37391
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2079 - Buy Me A Coffee Plugin
The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the recieve_post, bmc_disconnect, name_post, and widget_post functions in versions up to, and including, 3.7. This makes it possible for unauthenticated attackers to update the plugins settings, via a forged request granted the attacker can trick a site's administrator into performing an action such as clicking on a link.
PLUGIN
Buy Me A Coffee
CVE-2023-2079
Risk Score