Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-2482 - Responsive Css Editor Plugin
The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admin.
PLUGIN
Responsive Css Editor
CVE-2023-2482
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2623 - Before 3 Plugin
The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to retrieve sensitive information such as the user email and hashed password of other users
PLUGIN
Before 3
CVE-2023-2623
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2326 - Gravity Forms Google Sheet Connector Plugin
The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugin through 1.3.5 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
PLUGIN
Gravity Forms Google Sheet Connector
CVE-2023-2326
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2605 - Before 2 Plugin
The wpbrutalai WordPress plugin before 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.
PLUGIN
Before 2
CVE-2023-2605
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-1891 - Before 1 Plugin
The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting
PLUGIN
Before 1
CVE-2023-1891
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0588 - Catalyst Connect Zoho Crm Client Portal Plugin
The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin.
PLUGIN
Catalyst Connect Zoho Crm Client Portal
CVE-2023-0588
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2580 - Ai Engine Plugin
The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
PLUGIN
Ai Engine
CVE-2023-2580
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2178 - Aajoda Testimonials Plugin
The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Aajoda Testimonials
CVE-2023-2178
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-1166 - Before 16 Plugin
The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
PLUGIN
Before 16
CVE-2023-1166
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0873 - Kanban Boards For Plugin
The Kanban Boards for WordPress plugin before 2.5.21 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Kanban Boards For
CVE-2023-0873
Risk Score
Threat Entry
Updated 2025-01-13
CVE-2023-3412 - Image Map Pro Plugin
The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.0. This is due to a missing capability check on the ajax_store_save() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify plugin settings and inject malicious web scripts.
PLUGIN
Image Map Pro
CVE-2023-3412
Risk Score
Threat Entry
Updated 2025-01-13
CVE-2023-3411 - Image Map Pro Plugin
The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing nonce validation on the ajax_store_save() function. This makes it possible for unauthenticated attackers to modify plugin settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Image Map Pro
CVE-2023-3411
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3132 - Mainwp Child Plugin
The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufficient controls on the storage of back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including the entire installations database if a backup occurs and the deletion of the back-up files fail.
PLUGIN
Mainwp Child
CVE-2023-3132
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3371 - Embedpress Plugin
The User Registration plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'lock_content_form_handler' and 'display_password_form' function in versions up to, and including, 3.7.3. This makes it possible for unauthenticated attackers to decrypt and view the password protected content.
PLUGIN
Embedpress
CVE-2023-3371
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-29434 - Optin Forms Plugin
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FancyThemes Optin Forms – Simple List Building Plugin for WordPress plugin
PLUGIN
Optin Forms
CVE-2023-29434
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3197 - Mstore Api Plugin
The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Mstore Api
CVE-2023-3197
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3388 - Beautiful Cookie Consent Banner Plugin
The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A partial patch was made available in 2.10.1 and the issue was fully patched in 2.10.2.
PLUGIN
Beautiful Cookie Consent Banner
CVE-2023-3388
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3387 - Lana Text To Image Plugin
The Lana Text to Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lana_text_to_image' and 'lana_text_to_img' shortcode in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Lana Text To Image
CVE-2023-3387
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-34028 - Wolf Wordpress Posts Bulk Editor And Manager Professional Plugin
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin
PLUGIN
Wolf Wordpress Posts Bulk Editor And Manager Professional
CVE-2023-34028
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-32960 - Updraftplus Plugin
Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin
PLUGIN
Updraftplus
CVE-2023-32960
Risk Score