Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-12
CVE-2024-10547 - Wp Membership Plugin
The WP Membership plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the user_profile_image_upload() function in all versions up to, and including, 1.6.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Wp Membership
CVE-2024-10547
Risk Score
Threat Entry
Updated 2025-01-29
CVE-2024-10508 - Registrationmagic Plugin
The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0.2.6. This is due to the plugin not properly validating the password reset token prior to updating a user's password. This makes it possible for unauthenticated attackers to reset the password of arbitrary users, including administrators, and gain access to these accounts.
PLUGIN
Registrationmagic
CVE-2024-10508
Risk Score
Threat Entry
Updated 2025-12-23
CVE-2024-10470 - Wordpress Learning Management System Plugin
The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks in the readfile and unlink functions in all versions up to, and including, 4.962. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The theme is vulnerable even when it is not activated.
PLUGIN
Wordpress Learning Management System
CVE-2024-10470
Risk Score
Threat Entry
Updated 2025-06-05
CVE-2024-10627 - Woocommerce Support Ticket System Plugin
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_upload() function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Woocommerce Support Ticket System
CVE-2024-10627
Risk Score
Threat Entry
Updated 2025-05-28
CVE-2024-10625 - Woocommerce Support Ticket System Plugin
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
PLUGIN
Woocommerce Support Ticket System
CVE-2024-10625
Risk Score
Threat Entry
Updated 2024-11-12
CVE-2024-10586 - Debug Tool Plugin
The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbt_pull_image() function and missing file type validation in all versions up to, and including, 2.2. This makes it possible for unauthenticated attackers to to create arbitrary files such as .php files that can be leveraged for remote code execution.
PLUGIN
Debug Tool
CVE-2024-10586
Risk Score
Threat Entry
Updated 2025-01-29
CVE-2024-10285 - Ce21 Suite Plugin
The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to log in the user associated with the JWT token.
PLUGIN
Ce21 Suite
CVE-2024-10285
Risk Score
Threat Entry
Updated 2025-01-29
CVE-2024-10284 - Ce21 Suite Plugin
The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.2.0. This is due to hardcoded encryption key in the 'ce21_authentication_phrase' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
PLUGIN
Ce21 Suite
CVE-2024-10284
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-7982 - Registrations For The Events Calendar Plugin
The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event registrations, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
PLUGIN
Registrations For The Events Calendar
CVE-2024-7982
Risk Score
Threat Entry
Updated 2024-11-08
CVE-2024-8615 - Jobsearch Wp Job Board Plugin
The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_location_load_excel_file_callback() function in all versions up to, and including, 2.6.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Jobsearch Wp Job Board
CVE-2024-8615
Risk Score
Threat Entry
Updated 2024-11-08
CVE-2024-8614 - Jobsearch Wp Job Board Plugin
The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_wp_handle_upload() function in all versions up to, and including, 2.6.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Jobsearch Wp Job Board
CVE-2024-8614
Risk Score
Threat Entry
Updated 2024-11-08
CVE-2024-9307 - Mfolio Plugin
The mFolio Lite plugin for WordPress is vulnerable to file uploads due to a missing capability check in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file or upload arbitrary EXE files on the affected site's server which may make remote code execution possible if the attacker can also gain access to run the .exe file, or trick a site visitor into downloading…
PLUGIN
Mfolio
CVE-2024-9307
Risk Score
Threat Entry
Updated 2024-11-08
CVE-2024-10687 - Contest Gallery Plugin
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons plugin for WordPress is vulnerable to time-based SQL Injection via the $collectedIds parameter in all versions up to, and including, 24.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Contest Gallery
CVE-2024-10687
Risk Score
Threat Entry
Updated 2024-11-01
CVE-2024-10392 - Complete Ai Pack Plugin
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_image_upload' function in all versions up to, and including, 1.8.89. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Complete Ai Pack
CVE-2024-10392
Risk Score
Threat Entry
Updated 2024-11-01
CVE-2024-8512 - W3speedster Wp Plugin
The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBeforeStartOptimization() function. This is due to the plugin passing user supplied input to eval(). This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
PLUGIN
W3speedster Wp
CVE-2024-8512
Risk Score
Threat Entry
Updated 2024-11-07
CVE-2024-9989 - Crypto Tool Plugin
The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.15. This is due a to limited arbitrary method call to 'crypto_connect_ajax_process::log_in' function in the 'crypto_connect_ajax_process' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
PLUGIN
Crypto Tool
CVE-2024-9989
Risk Score
Threat Entry
Updated 2024-11-07
CVE-2024-9988 - Crypto Tool Plugin
The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.15. This is due to missing validation on the user being supplied in the 'crypto_connect_ajax_process::register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
PLUGIN
Crypto Tool
CVE-2024-9988
Risk Score
Threat Entry
Updated 2024-10-29
CVE-2024-50427 - WordPress Core
Unrestricted Upload of File with Dangerous Type vulnerability in Devsoft Baltic OÜ SurveyJS: Drag & Drop WordPress Form Builder.This issue affects SurveyJS: Drag & Drop WordPress Form Builder: from n/a through 1.9.136.
CORE
WordPress Core
CVE-2024-50427
Risk Score
Threat Entry
Updated 2024-11-08
CVE-2024-50496 - Ar Plugin
Unrestricted Upload of File with Dangerous Type vulnerability in Web and Print Design AR For WordPress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through 6.2.
PLUGIN
Ar
CVE-2024-50496
Risk Score
Threat Entry
Updated 2024-10-28
CVE-2024-9501 - Wp Social Plugin
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.0.7. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
PLUGIN
Wp Social
CVE-2024-9501
Risk Score