Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-02-14
CVE-2023-0820 - User Role By Bestwebsoft Plugin
The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.
PLUGIN
User Role By Bestwebsoft
CVE-2023-0820
Risk Score
Threat Entry
Updated 2025-02-14
CVE-2023-1124 - Ecommerce Store Plugin
The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks.
PLUGIN
Ecommerce Store
CVE-2023-1124
Risk Score
Threat Entry
Updated 2025-02-14
CVE-2023-0399 - Image Over Image For Wpbakery Page Builder Plugin
The Image Over Image For WPBakery Page Builder WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Image Over Image For Wpbakery Page Builder
CVE-2023-0399
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-25040 - Shortcodes Ultimate Plugin
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugin
PLUGIN
Shortcodes Ultimate
CVE-2023-25040
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-23677 - Gtmetrix Plugin
Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin
PLUGIN
Gtmetrix
CVE-2023-23677
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-23670 - Fancy Comments Plugin
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Team Heateor Fancy Comments WordPress plugin
PLUGIN
Fancy Comments
CVE-2023-23670
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-1575 - Mega Main Menu Plugin
The Mega Main Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Mega Main Menu
CVE-2023-1575
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-1509 - Gmace Plugin
The GMAce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.2. This is due to missing nonce validation on the gmace_manager_server function called via the wp_ajax_gmace_manager AJAX action. This makes it possible for unauthenticated attackers to modify arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Gmace
CVE-2023-1509
Risk Score
Threat Entry
Updated 2025-02-19
CVE-2023-0955 - Wp Statistics Plugin
The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.
PLUGIN
Wp Statistics
CVE-2023-0955
Risk Score
Threat Entry
Updated 2025-02-19
CVE-2023-1093 - Oauth Single Sign On Plugin
The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack
PLUGIN
Oauth Single Sign On
CVE-2023-1093
Risk Score
Threat Entry
Updated 2025-02-19
CVE-2023-1092 - Oauth Single Sign On Free Plugin
The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack
PLUGIN
Oauth Single Sign On Free
CVE-2023-1092
Risk Score
Threat Entry
Updated 2025-02-19
CVE-2023-0816 - Formidable Forms Plugin
The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections.
PLUGIN
Formidable Forms
CVE-2023-0816
Risk Score
Threat Entry
Updated 2025-02-18
CVE-2023-1069 - Complianz Premium Plugin
The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Complianz Premium
CVE-2023-1069
Risk Score
Threat Entry
Updated 2025-02-19
CVE-2023-0823 - Before 2 Plugin
The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.4.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Before 2
CVE-2023-0823
Risk Score
Threat Entry
Updated 2025-02-19
CVE-2023-0660 - Smart Slider 3 Plugin
The Smart Slider 3 WordPress plugin before 3.5.1.14 does not properly validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Smart Slider 3
CVE-2023-0660
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2023-0589 - Wp Image Carousel Plugin
The WP Image Carousel WordPress plugin through 1.0.2 does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
PLUGIN
Wp Image Carousel
CVE-2023-0589
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2023-1400 - Modern Events Calendar Lite Plugin
The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Modern Events Calendar Lite
CVE-2023-1400
Risk Score
Threat Entry
Updated 2025-02-26
CVE-2023-1025 - Simple File List Plugin
The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Simple File List
CVE-2023-1025
Risk Score
Threat Entry
Updated 2025-02-19
CVE-2023-1089 - Before 1 Plugin
The Coupon Zen WordPress plugin before 1.0.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
PLUGIN
Before 1
CVE-2023-1089
Risk Score
Threat Entry
Updated 2025-02-19
CVE-2023-1088 - Wp Plugin Manager
The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
PLUGIN
Wp Plugin Manager
CVE-2023-1088
Risk Score