Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2022-1710 - Appointment Hour Booking Plugin
The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
PLUGIN
Appointment Hour Booking
CVE-2022-1710
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1594 - Hc Custom Wp Admin Url Plugin
The HC Custom WP-Admin URL WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, allowing them to change the login URL
PLUGIN
Hc Custom Wp Admin Url
CVE-2022-1594
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0885 - Member Hero Plugin
The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.
PLUGIN
Member Hero
CVE-2022-0885
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0827 - Bestbooks Plugin
The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
PLUGIN
Bestbooks
CVE-2022-0827
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0786 - Before 2 Plugin
The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users
PLUGIN
Before 2
CVE-2022-0786
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1202 - Wp Crm Plugin
The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.
PLUGIN
Wp Crm
CVE-2022-1202
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1412 - Log Wp Mail Plugin
The Log WP_Mail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filenames, allowing any unauthenticated visitor to obtain potentially sensitive information like generated passwords.
PLUGIN
Log Wp Mail
CVE-2022-1412
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0863 - Wp Svg Icons Plugin
The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution.
PLUGIN
Wp Svg Icons
CVE-2022-0863
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0745 - Like Button Rating Plugin
The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipient, with any subject and body
PLUGIN
Like Button Rating
CVE-2022-0745
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1208 - Ultimate Member Plugin
The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to insufficient input sanitization and output escaping that allows users to encode malicious web scripts with HTML encoding that is reflected back on the page. This affects versions up to, and including, 2.3.2. Please note this issue was only partially fixed in version 2.3.2.
PLUGIN
Ultimate Member
CVE-2022-1208
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1532 - Before 1 Plugin
Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
PLUGIN
Before 1
CVE-2022-1532
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0626 - Advanced Admin Search Plugin
The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting.
PLUGIN
Advanced Admin Search
CVE-2022-0626
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1336 - Carousel Ck Plugin
The Carousel CK WordPress plugin through 1.1.0 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
PLUGIN
Carousel Ck
CVE-2022-1336
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1335 - Before 1 Plugin
The Slideshow CK WordPress plugin before 1.4.10 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
PLUGIN
Before 1
CVE-2022-1335
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25116 - Enqueue Anything Plugin
The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put arbitrary posts in the trash.
PLUGIN
Enqueue Anything
CVE-2021-25116
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1692 - Cp Image Store With Slideshow Plugin
The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack
PLUGIN
Cp Image Store With Slideshow
CVE-2022-1692
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1683 - Amtythumb Plugin
The amtyThumb WordPress plugin through 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement via its shortcode, leading to an SQL injection and is exploitable by any authenticated user (and not just Author+ like the original advisory mention) due to the fact that they can execute shortcodes via an AJAX action
PLUGIN
Amtythumb
CVE-2022-1683
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1673 - Woocommerce Green Wallet Gateway Plugin
The WooCommerce Green Wallet Gateway WordPress plugin before 1.0.2 does not escape the error_envision query parameter before outputting it to the page, leading to a Reflected Cross-Site Scripting vulnerability.
PLUGIN
Woocommerce Green Wallet Gateway
CVE-2022-1673
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1691 - Realty Workstation Plugin
The Realty Workstation WordPress plugin before 1.0.15 does not sanitise and escape the trans_edit parameter before using it in a SQL statement when an agent edit a transaction, leading to an SQL injection
PLUGIN
Realty Workstation
CVE-2022-1691
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1685 - Five Minute Webshop Plugin
The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection
PLUGIN
Five Minute Webshop
CVE-2022-1685
Risk Score