Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-1155 - Cost Calculator Plugin
The Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the nd_cc_meta_box_cc_price_icon parameter in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Cost Calculator
CVE-2023-1155
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0085 - Metform Elementor Contact Form Builder Plugin
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypass Captcha restrictions and for attackers to utilize bots to submit forms.
PLUGIN
Metform Elementor Contact Form Builder
CVE-2023-0085
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-1112 - Drag And Drop Multiple File Upload Contact Form 7 Plugin
A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222072.
PLUGIN
Drag And Drop Multiple File Upload Contact Form 7
CVE-2023-1112
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-1080 - Gn Publisher Plugin
The GN Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Gn Publisher
CVE-2023-1080
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-1023 - Wp Meta Seo Plugin
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the saveSitemapSettings function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to change sitemap-related settings of the plugin. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
PLUGIN
Wp Meta Seo
CVE-2023-1023
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-1028 - Wp Meta Seo Plugin
The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to missing or incorrect nonce validation on the setIgnore function. This makes it possible for unauthenticated attackers to update plugin options via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Wp Meta Seo
CVE-2023-1028
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-1027 - Wp Meta Seo Plugin
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the checkAllCategoryInSitemap function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to obtain post categories. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
PLUGIN
Wp Meta Seo
CVE-2023-1027
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-1026 - Wp Meta Seo Plugin
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the listPostsCategory function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to get post listings by category as long as those posts are published. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
PLUGIN
Wp Meta Seo
CVE-2023-1026
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-1024 - Wp Meta Seo Plugin
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the regenerateSitemaps function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to generate sitemaps. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
PLUGIN
Wp Meta Seo
CVE-2023-1024
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-1022 - Wp Meta Seo Plugin
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized options update due to a missing capability check on the wpmsGGSaveInformation function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to update google analytics options maintained by the plugin. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
PLUGIN
Wp Meta Seo
CVE-2023-1022
Risk Score
Threat Entry
Updated 2025-03-18
CVE-2023-0381 - Gigpress Plugin
The GigPress WordPress plugin through 2.3.28 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks
PLUGIN
Gigpress
CVE-2023-0381
Risk Score
Threat Entry
Updated 2025-03-10
CVE-2023-0487 - My Sticky Elements Plugin
The My Sticky Elements WordPress plugin before 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement when deleting messages, leading to a SQL injection exploitable by high privilege users such as admin
PLUGIN
My Sticky Elements
CVE-2023-0487
Risk Score
Threat Entry
Updated 2025-03-10
CVE-2023-0334 - Shortpixel Adaptive Images Plugin
The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin
PLUGIN
Shortpixel Adaptive Images
CVE-2023-0334
Risk Score
Threat Entry
Updated 2025-03-18
CVE-2023-0552 - Registration Forms Plugin
The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in and login out, leading to an Open Redirect vulnerability
PLUGIN
Registration Forms
CVE-2023-0552
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0539 - Gs Insever Portfolio Plugin
The GS Insever Portfolio WordPress plugin before 1.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Gs Insever Portfolio
CVE-2023-0539
Risk Score
Threat Entry
Updated 2025-03-10
CVE-2023-0535 - Donation Block For Paypal Plugin
The Donation Block For PayPal WordPress plugin before 2.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Donation Block For Paypal
CVE-2023-0535
Risk Score
Threat Entry
Updated 2025-03-10
CVE-2023-0548 - Before 2 Plugin
The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 2
CVE-2023-0548
Risk Score
Threat Entry
Updated 2025-03-11
CVE-2023-0543 - Arigato Autoresponder And Newsletter Plugin
The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Arigato Autoresponder And Newsletter
CVE-2023-0543
Risk Score
Threat Entry
Updated 2025-03-10
CVE-2023-0331 - Correos Oficial Plugin
The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server.
PLUGIN
Correos Oficial
CVE-2023-0331
Risk Score
Threat Entry
Updated 2025-03-10
CVE-2023-0279 - Media Library Assistant Plugin
The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
PLUGIN
Media Library Assistant
CVE-2023-0279
Risk Score