Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-0831 - Under Construction Plugin
The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incorrect nonce validation on the dismiss_notice function called via the admin_action_ucp_dismiss_notice action. This makes it possible for unauthenticated attackers to dismiss plugin notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Under Construction
CVE-2023-0831
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0721 - Metform Elementor Contact Form Builder Plugin
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
PLUGIN
Metform Elementor Contact Form Builder
CVE-2023-0721
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0729 - Wicked Folders Plugin
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_sort_order function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
PLUGIN
Wicked Folders
CVE-2023-0729
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0710 - Metform Elementor Contact Form Builder Plugin
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mf_thankyou' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted…
PLUGIN
Metform Elementor Contact Form Builder
CVE-2023-0710
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0709 - Metform Elementor Contact Form Builder Plugin
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form…
PLUGIN
Metform Elementor Contact Form Builder
CVE-2023-0709
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0708 - Metform Elementor Contact Form Builder Plugin
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_first_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form…
PLUGIN
Metform Elementor Contact Form Builder
CVE-2023-0708
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0695 - Metform Elementor Contact Form Builder Plugin
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a specific link. Note that getting the JavaScript to execute still requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
PLUGIN
Metform Elementor Contact Form Builder
CVE-2023-0695
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0694 - Metform Elementor Contact Form Builder Plugin
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about any standard form field of any form submission.
PLUGIN
Metform Elementor Contact Form Builder
CVE-2023-0694
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0693 - Metform Elementor Contact Form Builder Plugin
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the transaction ids of arbitrary form submissions that included payment.
PLUGIN
Metform Elementor Contact Form Builder
CVE-2023-0693
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0692 - Metform Elementor Contact Form Builder Plugin
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the payment status of arbitrary form submissions.
PLUGIN
Metform Elementor Contact Form Builder
CVE-2023-0692
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0688 - Metform Elementor Contact Form Builder Plugin
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form submissions, including payment status, and transaction ID.
PLUGIN
Metform Elementor Contact Form Builder
CVE-2023-0688
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0691 - Metform Elementor Contact Form Builder Plugin
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissions, specifically the submitter's last name.
PLUGIN
Metform Elementor Contact Form Builder
CVE-2023-0691
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0292 - Quiz And Survey Master Plugin
The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is due to missing nonce validation on the function associated with the qsm_remove_file_fd_question AJAX action. This makes it possible for unauthenticated attackers to delete arbitrary media files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Quiz And Survey Master
CVE-2023-0292
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0291 - Quiz And Survey Master Plugin
The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files.
PLUGIN
Quiz And Survey Master
CVE-2023-0291
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2986 - Abandoned Cart Lite For Woocommerce Plugin
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key…
PLUGIN
Abandoned Cart Lite For Woocommerce
CVE-2023-2986
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-46889 - Photo Gallery Plugin
The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-31693.
PLUGIN
Photo Gallery
CVE-2021-46889
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4380 - Pinterest Automatic Pin Plugin
The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_request' function and the 'process_form.php' script in versions up to, and including, 1.14.3. This makes it possible for unauthenticated attackers to update arbitrary options on a site that can be used to create new administrative user accounts or redirect unsuspecting site visitors.
PLUGIN
Pinterest Automatic Pin
CVE-2021-4380
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4337 - Share Print And Pdf Products Plugin
Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0,…
PLUGIN
Share Print And Pdf Products
CVE-2021-4337
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4379 - Woocommerce Multi Currency Plugin
The WooCommerce Multi Currency plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wmc_bulk_fixed_price function in versions up to, and including, 2.1.17. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to make changes to product prices.
PLUGIN
Woocommerce Multi Currency
CVE-2021-4379
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3125 - B2bking Plugin
The B2BKing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'b2bking_save_price_import' function in versions up to, and including, 4.6.00. This makes it possible for Authenticated attackers with subscriber or customer-level permissions to modify the pricing of any product on the site.
PLUGIN
B2bking
CVE-2023-3125
Risk Score