Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2022-23984 - Wpdiscuz Plugin
Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions
PLUGIN
Wpdiscuz
CVE-2022-23984
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-26256 - Survey Maker Plugin
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions
PLUGIN
Survey Maker
CVE-2021-26256
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0134 - Before 0 Plugin
The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack
PLUGIN
Before 0
CVE-2022-0134
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0255 - Database Backup For Plugin
The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue
PLUGIN
Database Backup For
CVE-2022-0255
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0228 - Popup Builder Plugin
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
PLUGIN
Popup Builder
CVE-2022-0228
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-4208 - Exportfeed Plugin
The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the product_id POST parameter before using it in a SQL statement, leading to a SQL injection vulnerability exploitable by high privilege users
PLUGIN
Exportfeed
CVE-2021-4208
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0288 - Ad Inserter Pro Plugin
The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_selection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
PLUGIN
Ad Inserter Pro
CVE-2022-0288
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0252 - Givewp Plugin
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting
PLUGIN
Givewp
CVE-2022-0252
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0234 - Before 1 Plugin
The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting
PLUGIN
Before 1
CVE-2022-0234
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0186 - Image Photo Gallery Final Tiles Grid Plugin
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard
PLUGIN
Image Photo Gallery Final Tiles Grid
CVE-2022-0186
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0211 - Shield Security Plugin
The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
PLUGIN
Shield Security
CVE-2022-0211
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0313 - Float Menu Plugin
The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack
PLUGIN
Float Menu
CVE-2022-0313
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0199 - Before 3 Plugin
The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF attack
PLUGIN
Before 3
CVE-2022-0199
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0164 - Before 3 Plugin
The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowing any authenticated users, with a role as low as subscriber to send arbitrary emails to all subscribed users
PLUGIN
Before 3
CVE-2022-0164
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0279 - Before 0 Plugin
The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users
PLUGIN
Before 0
CVE-2022-0279
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24867 - Ap Companion Plugin
Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion
PLUGIN
Ap Companion
CVE-2021-24867
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25082 - Before 4 Plugin
The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR
PLUGIN
Before 4
CVE-2021-25082
Risk Score
Threat Entry
Updated 2025-03-21
CVE-2021-25069 - Before 3 Plugin
The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statement, leading to a SQL injection, which can also be exploited to cause a Reflected Cross-Site Scripting issue
PLUGIN
Before 3
CVE-2021-25069
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25100 - Before 2 Plugin
The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting
PLUGIN
Before 2
CVE-2021-25100
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25099 - Givewp Plugin
The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting
PLUGIN
Givewp
CVE-2021-25099
Risk Score