Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-3126 - B2bking Plugin
The B2BKing plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'b2bkingdownloadpricelist' function in versions up to, and including, 4.6.00. This makes it possible for Authenticated attackers with subscriber or customer-level permissions to retrieve the full pricing list of all products on the site.
PLUGIN
B2bking
CVE-2023-3126
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4381 - Ulisting Plugin
The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing security nonce, in the StmListingSingleLayout::import_new_layout method in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to change any WordPress option in the database.
PLUGIN
Ulisting
CVE-2021-4381
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4374 - Wordpress Automatic Plugin
The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option validation in the process_form.php file. This makes it possible for unauthenticated attackers to arbitrarily update the settings of a vulnerable site and ultimately compromise the entire site.
PLUGIN
Wordpress Automatic
CVE-2021-4374
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-3124 - Elementor Pro Plugin
The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to, and including, 3.11.6. This makes it possible for authenticated attackers with subscriber-level capabilities to update arbitrary site options, which can lead to privilege escalation.
PLUGIN
Elementor Pro
CVE-2023-3124
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4382 - Recently Plugin
The Recently plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the fetch_external_image() function in versions up to, and including, 3.0.4. This makes it possible for authenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Recently
CVE-2021-4382
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4373 - Better Search Plugin
The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to import settings via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Better Search
CVE-2021-4373
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4383 - Wp Quick Frontend Editor Plugin
The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due to missing capability checks in the plugin's page-editing functionality. This makes it possible for low-authenticated attackers, such as subscribers, to edit/create any page or post on the blog.
PLUGIN
Wp Quick Frontend Editor
CVE-2021-4383
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4377 - Doneren Met Mollie Plugin
The Doneren met Mollie plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.8.5 via the dmm_export_donations() function which is called via the admin_post_dmm_export hook due to missing capability checks. This can allow authenticated attackers to extract a CSV file that contains sensitive information about the donors.
PLUGIN
Doneren Met Mollie
CVE-2021-4377
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4372 - Woocommerce Dynamic Pricing And Discounts Plugin
The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.1. This is due to missing sanitization on the settings imported via the import() function. This makes it possible for unauthenticated attackers to import a settings file containing malicious JavaScript that would execute when an administrator accesses the settings area of the site.
PLUGIN
Woocommerce Dynamic Pricing And Discounts
CVE-2021-4372
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4378 - Wp Quick Frontend Editor Plugin
The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with minimal permissions like subscribers, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wp Quick Frontend Editor
CVE-2021-4378
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4376 - Woocommerce Multi Currency Plugin
The WooCommerce Multi Currency plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.17. This makes it possible for authenticated attackers to change the price of a product to an arbitrary value.
PLUGIN
Woocommerce Multi Currency
CVE-2021-4376
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4375 - Welcart E Commerce Plugin
The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the usces_download_system_information() function in versions up to, and including, 2.2.7. This makes it possible for authenticated attackers to download information including WordPress settings, plugin settings, PHP settings and server settings.
PLUGIN
Welcart E Commerce
CVE-2021-4375
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4368 - Frontend File Manager Plugin
The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2. This is due to lacking capability checks and a security nonce, all on the wpfm_save_settings AJAX action. This makes it possible for subscriber-level attackers to edit the plugin settings, such as the allowed upload file types. This can lead to remote code execution through other vulnerabilities.
PLUGIN
Frontend File Manager
CVE-2021-4368
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4360 - Controlled Admin Access Plugin
The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This makes it possible for attackers to create a new administrator role with unrestricted access.
PLUGIN
Controlled Admin Access
CVE-2021-4360
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4370 - Ulisting Plugin
The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is seldom validated. This issue exists in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to conduct numerous administrative actions, including those less critical than the explicitly outlined ones in our detection.
PLUGIN
Ulisting
CVE-2021-4370
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-4362 - Kiwi Social Share Plugin
The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi_social_share_get_option() function called via the kiwi_social_share_get_option AJAX action in version 2.1.0. This makes it possible for unauthenticated attackers to read and modify arbitrary options on a WordPress site that can be used for complete site takeover. This was a previously fixed vulnerability that was reintroduced in this version.
PLUGIN
Kiwi Social Share
CVE-2021-4362
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4357 - Ulisting Plugin
The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on the UlistingUserRole::save_role_api function in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to arbitrarily delete site posts and pages.
PLUGIN
Ulisting
CVE-2021-4357
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4356 - Frontend File Manager Plugin
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, 18.2. This is due to lacking authentication protections, capability checks, and sanitization, all on the wpfm_file_meta_update AJAX action. This makes it possible for unauthenticated attackers to download arbitrary files on the site, potentially leading to site takeover.
PLUGIN
Frontend File Manager
CVE-2021-4356
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4361 - Jobsearch Wp Job Board Plugin
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job_integrations_settin_save AJAX action in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to update arbitrary options on the site.
PLUGIN
Jobsearch Wp Job Board
CVE-2021-4361
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4365 - Frontend File Manager Plugin
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including, 18.2. This is due to lacking authentication protections and santisation all on the wpfm_edit_file_title_desc AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Frontend File Manager
CVE-2021-4365
Risk Score