Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-2078 - Buy Me A Coffee Plugin
The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the recieve_post, bmc_disconnect, name_post, and widget_post functions in versions up to, and including, 3.7. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to update the plugins settings. CVE-2023-25030 may be a duplicate of this issue.
PLUGIN
Buy Me A Coffee
CVE-2023-2078
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3219 - Before 2 Plugin
The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.
PLUGIN
Before 2
CVE-2023-3219
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3225 - Before 5 Plugin
The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 5
CVE-2023-3225
Risk Score
Threat Entry
Updated 2025-05-12
CVE-2023-3175 - Ai Chatbot Plugin
The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Ai Chatbot
CVE-2023-3175
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3129 - Url Shortify Plugin
The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Url Shortify
CVE-2023-3129
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3131 - Before 3 Plugin
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
PLUGIN
Before 3
CVE-2023-3131
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3209 - Before 3 Plugin
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
PLUGIN
Before 3
CVE-2023-3209
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3077 - Mstore Api Plugin
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin.
PLUGIN
Mstore Api
CVE-2023-3077
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3076 - Before 3 Plugin
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.
PLUGIN
Before 3
CVE-2023-3076
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-3118 - Export All Urls Plugin
The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Export All Urls
CVE-2023-3118
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2493 - All In One Redirection Plugin
The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
PLUGIN
All In One Redirection
CVE-2023-2493
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-2964 - Simple Iframe Plugin
The Simple Iframe WordPress plugin before 1.2.0 does not properly validate one of its WordPress block attribute's content, which may allow users whose role is at least that of a contributor to conduct Stored Cross-Site Scripting attacks.
PLUGIN
Simple Iframe
CVE-2023-2964
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2529 - Enable Svg Uploads Plugin
The Enable SVG Uploads WordPress plugin through 2.1.5 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
PLUGIN
Enable Svg Uploads
CVE-2023-2529
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2796 - Before 2 Plugin
The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.
PLUGIN
Before 2
CVE-2023-2796
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2023-2967 - Tinymce Custom Styles Plugin
The TinyMCE Custom Styles WordPress plugin before 1.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Tinymce Custom Styles
CVE-2023-2967
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2709 - An Gradebook Plugin
The AN_GradeBook WordPress plugin through 5.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
An Gradebook
CVE-2023-2709
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2635 - Before 1 Plugin
The Call Now Accessibility Button WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 1
CVE-2023-2635
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2578 - Buy Me A Coffee Plugin
The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Buy Me A Coffee
CVE-2023-2578
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2495 - Greeklish Permalink Plugin
The Greeklish-permalink WordPress plugin through 3.3 does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin's functionality to change Post slugs either directly or through CSRF.
PLUGIN
Greeklish Permalink
CVE-2023-2495
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2029 - Prepost Seo Plugin
The PrePost SEO WordPress plugin through 3.0 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Prepost Seo
CVE-2023-2029
Risk Score