Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-24913 - Before 2 Plugin
The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media.
PLUGIN
Before 2
CVE-2021-24913
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24864 - Weather Plugin
The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the post_id parameter before using it in a SQL statement in the admin dashboard, leading to a SQL Injection issue
PLUGIN
Weather
CVE-2021-24864
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24803 - Core Tweaks Wp Setup Plugin
The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks
PLUGIN
Core Tweaks Wp Setup
CVE-2021-24803
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24704 - Orange Form Plugin
In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example
PLUGIN
Orange Form
CVE-2021-24704
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24823 - Support Board Plugin
The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files
PLUGIN
Support Board
CVE-2021-24823
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24820 - Through 1 Plugin
The Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions
PLUGIN
Through 1
CVE-2021-24820
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24689 - Contact Form Plugin
The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack
PLUGIN
Contact Form
CVE-2021-24689
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24898 - Editable Table Plugin
The EditableTable WordPress plugin through 0.1.4 does not sanitise and escape any of the Table and Column fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
PLUGIN
Editable Table
CVE-2021-24898
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24730 - Logo Showcase With Slick Slider Plugin
The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media.
PLUGIN
Logo Showcase With Slick Slider
CVE-2021-24730
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24688 - Orange Form Plugin
The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_delete_filed one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing actions on posts also do not ensure that the post belong to them (or that they are allowed to perform such action on it)
PLUGIN
Orange Form
CVE-2021-24688
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-25149 - Wp Statistics Plugin
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
PLUGIN
Wp Statistics
CVE-2022-25149
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-25148 - Wp Statistics Plugin
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
PLUGIN
Wp Statistics
CVE-2022-25148
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-25307 - Wp Statistics Plugin
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
PLUGIN
Wp Statistics
CVE-2022-25307
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-25306 - Wp Statistics Plugin
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-statistics-visitor.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
PLUGIN
Wp Statistics
CVE-2022-25306
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-25305 - Wp Statistics Plugin
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
PLUGIN
Wp Statistics
CVE-2022-25305
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0651 - Wp Statistics Plugin
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
PLUGIN
Wp Statistics
CVE-2022-0651
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0683 - Essential Addons For Elementor Lite Plugin
The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the settings parameter found in the ~/includes/Traits/Helper.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 5.0.8.
PLUGIN
Essential Addons For Elementor Lite
CVE-2022-0683
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0653 - User Registration Forms Plugin
The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.
PLUGIN
User Registration Forms
CVE-2022-0653
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-25599 - Spiffy Calendar Plugin
Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions
PLUGIN
Spiffy Calendar
CVE-2022-25599
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-23983 - Wp Content Copy Protection No Right Click Plugin
Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions
PLUGIN
Wp Content Copy Protection No Right Click
CVE-2022-23983
Risk Score