Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-03-10
CVE-2024-1698 - Notificationx Plugin
The NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Notificationx
CVE-2024-1698
Risk Score
Threat Entry
Updated 2024-12-18
CVE-2024-1512 - Masterstudy Lms Plugin
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Masterstudy Lms
CVE-2024-1512
Risk Score
Threat Entry
Updated 2025-02-26
CVE-2024-0610 - Piraeus Bank Woocommerce Payment Gateway Plugin
The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'MerchantReference' parameter in all versions up to, and including, 1.6.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Piraeus Bank Woocommerce Payment Gateway
CVE-2024-0610
Risk Score
Threat Entry
Updated 2025-05-06
CVE-2023-6036 - Before 3 Plugin
The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
PLUGIN
Before 3
CVE-2023-6036
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-1207 - Booking Calendar Plugin
The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to, and including, 9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Booking Calendar
CVE-2024-1207
Risk Score
Threat Entry
Updated 2025-03-18
CVE-2024-0709 - Cryptocurrency Widgets Plugin
The Cryptocurrency Widgets – Price Ticker & Coins List plugin for WordPress is vulnerable to SQL Injection via the 'coinslist' parameter in versions 2.0 to 2.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Cryptocurrency Widgets
CVE-2024-0709
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-0221 - Photo Gallery Plugin
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8.19 via the rename_item function. This makes it possible for authenticated attackers to rename arbitrary files on the server. This can lead to site takeovers if the wp-config.php file of a site can be renamed. By default this can be exploited by administrators only. In the premium version of the plugin, administrators can give gallery management permissions to lower level users, which might make this exploitable…
PLUGIN
Photo Gallery
CVE-2024-0221
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6989 - Shield Security Plugin
The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
PLUGIN
Shield Security
CVE-2023-6989
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6933 - Better Search Replace Plugin
The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
PLUGIN
Better Search Replace
CVE-2023-6933
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-4436 - 3dprint Lite Plugin
The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlite_handle_upload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be accessed on Web servers such as Apache.
PLUGIN
3dprint Lite
CVE-2021-4436
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-0705 - Stripe Payment Plugin For Woocommerce
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 3.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Stripe Payment Plugin For Woocommerce
CVE-2024-0705
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2021-4434 - Social Warfare Plugin
The Social Warfare plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.5.2 via the 'swp_url' parameter. This allows attackers to execute code on the server.
PLUGIN
Social Warfare
CVE-2021-4434
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2023-3211 - Wordpress Database Administrator Plugin
The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
PLUGIN
Wordpress Database Administrator
CVE-2023-3211
Risk Score
Threat Entry
Updated 2025-06-13
CVE-2023-0224 - Before 2 Plugin
The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform SQL Injection attacks
PLUGIN
Before 2
CVE-2023-0224
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2023-6623 - Essential Blocks Plugin
The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks.
PLUGIN
Essential Blocks
CVE-2023-6623
Risk Score
Threat Entry
Updated 2025-06-03
CVE-2023-6049 - Estatik Real Estate Plugin
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog
PLUGIN
Estatik Real Estate
CVE-2023-6049
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6979 - Customer Reviews For Woocommerce Plugin
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ivole_import_upload_csv AJAX action in all versions up to, and including, 5.38.9. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Customer Reviews For Woocommerce
CVE-2023-6979
Risk Score
Threat Entry
Updated 2025-06-04
CVE-2023-6875 - Post Smtp Plugin
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover.
PLUGIN
Post Smtp
CVE-2023-6875
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6567 - Learnpress Plugin
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Learnpress
CVE-2023-6567
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6316 - Mw Wp Form Plugin
The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the '_single_file_upload' function in versions up to, and including, 5.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Mw Wp Form
CVE-2023-6316
Risk Score