Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-15
CVE-2024-52376 - Stricted Upload Of File With Dangerous Type Vulnerability In Cmsminds Boat Rental Plugin
Unrestricted Upload of File with Dangerous Type vulnerability in cmsMinds Boat Rental Plugin for WordPress allows Upload a Web Shell to a Web Server.This issue affects Boat Rental Plugin for WordPress: from n/a through 1.0.1.
PLUGIN
Stricted Upload Of File With Dangerous Type Vulnerability In Cmsminds Boat Rental
CVE-2024-52376
Risk Score
Threat Entry
Updated 2024-11-19
CVE-2024-10571 - Chartify Plugin
The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
PLUGIN
Chartify
CVE-2024-10571
Risk Score
Threat Entry
Updated 2024-11-19
CVE-2024-11028 - Multimanager Wp Plugin
The MultiManager WP – Manage All Your WordPress Sites Easily plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the user impersonation feature inappropriately determining the current user via user-supplied input. This makes it possible for unauthenticated attackers to generate an impersonation link that will allow them to log in as any existing user, such as an administrator. NOTE: The user impersonation feature was disabled in version 1.1.0 and re-enabled with a patch in version 1.1.2.
PLUGIN
Multimanager Wp
CVE-2024-11028
Risk Score
Threat Entry
Updated 2024-11-19
CVE-2024-11150 - User Extra Fields Plugin
The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versions up to, and including, 16.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
PLUGIN
User Extra Fields
CVE-2024-11150
Risk Score
Threat Entry
Updated 2024-11-19
CVE-2024-10820 - Woocommerce Upload Files Plugin
The WooCommerce Upload Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in all versions up to, and including, 84.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Woocommerce Upload Files
CVE-2024-10820
Risk Score
Threat Entry
Updated 2024-11-12
CVE-2024-10245 - Relais 2fa Plugin
The Relais 2FA plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0. This is due to incorrect authentication and capability checking in the 'rl_do_ajax' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
PLUGIN
Relais 2fa
CVE-2024-10245
Risk Score
Threat Entry
Updated 2024-11-12
CVE-2024-10871 - Category Ajax Filter Plugin
The Category Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.2 via the 'params[caf-post-layout]' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with a .php extension can be uploaded and included.
PLUGIN
Category Ajax Filter
CVE-2024-10871
Risk Score
Threat Entry
Updated 2024-11-12
CVE-2024-10801 - Wordpress User Extra Fields Plugin
The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_upload() function in all versions up to, and including, 16.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. User registration must be enabled for this to be exploited.
PLUGIN
Wordpress User Extra Fields
CVE-2024-10801
Risk Score
Threat Entry
Updated 2024-11-12
CVE-2024-10589 - Leopard Wordpress Offload Media Plugin
The Leopard - WordPress Offload Media plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the import_settings() function in all versions up to, and including, 3.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
PLUGIN
Leopard Wordpress Offload Media
CVE-2024-10589
Risk Score
Threat Entry
Updated 2024-11-12
CVE-2024-10547 - Wp Membership Plugin
The WP Membership plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the user_profile_image_upload() function in all versions up to, and including, 1.6.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Wp Membership
CVE-2024-10547
Risk Score
Threat Entry
Updated 2025-01-29
CVE-2024-10508 - Registrationmagic Plugin
The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0.2.6. This is due to the plugin not properly validating the password reset token prior to updating a user's password. This makes it possible for unauthenticated attackers to reset the password of arbitrary users, including administrators, and gain access to these accounts.
PLUGIN
Registrationmagic
CVE-2024-10508
Risk Score
Threat Entry
Updated 2025-12-23
CVE-2024-10470 - Wordpress Learning Management System Plugin
The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks in the readfile and unlink functions in all versions up to, and including, 4.962. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The theme is vulnerable even when it is not activated.
PLUGIN
Wordpress Learning Management System
CVE-2024-10470
Risk Score
Threat Entry
Updated 2025-06-05
CVE-2024-10627 - Woocommerce Support Ticket System Plugin
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_upload() function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Woocommerce Support Ticket System
CVE-2024-10627
Risk Score
Threat Entry
Updated 2025-05-28
CVE-2024-10625 - Woocommerce Support Ticket System Plugin
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
PLUGIN
Woocommerce Support Ticket System
CVE-2024-10625
Risk Score
Threat Entry
Updated 2024-11-12
CVE-2024-10586 - Debug Tool Plugin
The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbt_pull_image() function and missing file type validation in all versions up to, and including, 2.2. This makes it possible for unauthenticated attackers to to create arbitrary files such as .php files that can be leveraged for remote code execution.
PLUGIN
Debug Tool
CVE-2024-10586
Risk Score
Threat Entry
Updated 2025-01-29
CVE-2024-10285 - Ce21 Suite Plugin
The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to log in the user associated with the JWT token.
PLUGIN
Ce21 Suite
CVE-2024-10285
Risk Score
Threat Entry
Updated 2025-01-29
CVE-2024-10284 - Ce21 Suite Plugin
The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.2.0. This is due to hardcoded encryption key in the 'ce21_authentication_phrase' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
PLUGIN
Ce21 Suite
CVE-2024-10284
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-7982 - Registrations For The Events Calendar Plugin
The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event registrations, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
PLUGIN
Registrations For The Events Calendar
CVE-2024-7982
Risk Score
Threat Entry
Updated 2024-11-08
CVE-2024-8615 - Jobsearch Wp Job Board Plugin
The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_location_load_excel_file_callback() function in all versions up to, and including, 2.6.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Jobsearch Wp Job Board
CVE-2024-8615
Risk Score
Threat Entry
Updated 2024-11-08
CVE-2024-8614 - Jobsearch Wp Job Board Plugin
The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_wp_handle_upload() function in all versions up to, and including, 2.6.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Jobsearch Wp Job Board
CVE-2024-8614
Risk Score