Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-0581 - Privatecontent Plugin
The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including, 8.4.3. This is due to the plugin checking if an IP had been blocklist via client-side scripts rather than server-side. This makes it possible for unauthenticated attackers to bypass any login restrictions that may prevent a brute force attack.
PLUGIN
Privatecontent
CVE-2023-0581
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0556 - Contentstudio Plugin
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata (via the function cstu_get_metadata) that includes the plugin's contentstudio_token. Knowing this token allows for other interactions with the plugin such as creating posts in versions prior to 1.2.5, which added other requirements to posting and updating.
PLUGIN
Contentstudio
CVE-2023-0556
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0558 - Contentstudio Plugin
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type juggling in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to execute functions intended for use by users with proper API keys.
PLUGIN
Contentstudio
CVE-2023-0558
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0557 - Contentstudio Plugin
The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could allow unauthenticated attackers to obtain a nonce needed for the creation of posts.
PLUGIN
Contentstudio
CVE-2023-0557
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0555 - Quick Restaurant Menu Plugin
The Quick Restaurant Menu plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those actions intended for administrator use. Actions include menu item creation, update and deletion and other menu management functions. Since the plugin does not verify that a post ID passed to one of its AJAX actions belongs to a menu item, this can lead to arbitrary post…
PLUGIN
Quick Restaurant Menu
CVE-2023-0555
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0554 - Quick Restaurant Menu Plugin
The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to update menu items, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Quick Restaurant Menu
CVE-2023-0554
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0550 - Quick Restaurant Menu Plugin
The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the fact that during menu item deletion/modification, the plugin does not verify that the post ID provided to the AJAX action is indeed a menu item. This makes it possible for authenticated attackers, with subscriber-level access or higher, to modify or delete arbitrary posts.
PLUGIN
Quick Restaurant Menu
CVE-2023-0550
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0553 - Quick Restaurant Menu Plugin
The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Quick Restaurant Menu
CVE-2023-0553
Risk Score
Threat Entry
Updated 2025-04-02
CVE-2023-0448 - Wp Helper Lite Plugin
The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability.
PLUGIN
Wp Helper Lite
CVE-2023-0448
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-22721 - Oi Yandex Maps Plugin
Auth. Stored Cross-Site Scripting (XSS) in Oi Yandex.Maps for WordPress
PLUGIN
Oi Yandex Maps
CVE-2023-22721
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0446 - My Youtube Channel Plugin
The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 3.0.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
My Youtube Channel
CVE-2023-0446
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0447 - My Youtube Channel Plugin
The My YouTube Channel plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the clear_all_cache function in versions up to, and including, 3.0.12.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to clear the plugin's cache.
PLUGIN
My Youtube Channel
CVE-2023-0447
Risk Score
Threat Entry
Updated 2025-04-02
CVE-2021-24881 - Before 3 Plugin
The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing unauthenticated users to bypass the protection offered by the plugin, and access arbitrary posts (such as private) content, by sending a specifically crafted request.
PLUGIN
Before 3
CVE-2021-24881
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24837 - Before 3 Plugin
The Passster WordPress plugin before 3.5.5.8 does not escape the area parameter of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
PLUGIN
Before 3
CVE-2021-24837
Risk Score
Threat Entry
Updated 2025-04-03
CVE-2023-23492 - Login With Phone Number Plugin
The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forgot_password' action.
PLUGIN
Login With Phone Number
CVE-2023-23492
Risk Score
Threat Entry
Updated 2025-04-03
CVE-2023-23490 - Survey Maker Plugin
The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parameter of its 'ays_surveys_export_json' action.
PLUGIN
Survey Maker
CVE-2023-23490
Risk Score
Threat Entry
Updated 2025-04-03
CVE-2023-23491 - Quick Event Manager Plugin
The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qem_ajax_calendar' action.
PLUGIN
Quick Event Manager
CVE-2023-23491
Risk Score
Threat Entry
Updated 2025-04-03
CVE-2023-23489 - Easy Digital Downloads Plugin
The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action.
PLUGIN
Easy Digital Downloads
CVE-2023-23489
Risk Score
Threat Entry
Updated 2025-04-03
CVE-2023-23488 - Paid Memberships Pro Plugin
The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route.
PLUGIN
Paid Memberships Pro
CVE-2023-23488
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0404 - Events Made Easy Plugin
The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those functions intended for administrator use. While the plugin is still pending review from the WordPress repository, site owners can download a copy of the patched version directly from the developer's Github at https://github.com/liedekef/events-made-easy
PLUGIN
Events Made Easy
CVE-2023-0404
Risk Score