Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2024-5153 - Startklar Elmentor Addons Plugin
The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.15 via the 'dropzone_hash' parameter. This makes it possible for unauthenticated attackers to copy the contents of arbitrary files on the server, which can contain sensitive information, and to delete arbitrary directories, including the root WordPress directory.
PLUGIN
Startklar Elmentor Addons
CVE-2024-5153
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4743 - Lifterlms Plugin
The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to SQL Injection via the orderBy attribute of the lifterlms_favorites shortcode in all versions up to, and including, 7.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Lifterlms
CVE-2024-4743
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4295 - Email Subscribers Newsletters Plugin
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in all versions up to, and including, 5.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Email Subscribers Newsletters
CVE-2024-4295
Risk Score
Threat Entry
Updated 2025-05-29
CVE-2024-4180 - Events Calendar Plugin
The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX.
PLUGIN
Events Calendar
CVE-2024-4180
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4552 - Social Login Lite For Woocommerce Plugin
The Social Login Lite For WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.6.0. This is due to insufficient verification on the user being supplied during the social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
PLUGIN
Social Login Lite For Woocommerce
CVE-2024-4552
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3820 - Table Charts Plugin
The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to SQL Injection via the 'id_key' parameter of the wdt_delete_table_row AJAX action in all versions up to, and including, 6.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Please note this only affects the premium…
PLUGIN
Table Charts
CVE-2024-3820
Risk Score
Threat Entry
Updated 2025-02-07
CVE-2024-3200 - Wpforo Forum Plugin
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo' shortcode in all versions up to, and including, 2.3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Wpforo Forum
CVE-2024-3200
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3412 - Migration Backup Restore Plugin
The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpstg_processing AJAX action in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Migration Backup Restore
CVE-2024-3412
Risk Score
Threat Entry
Updated 2025-05-21
CVE-2024-3050 - Site Reviews Plugin
The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass IP-based blocking
PLUGIN
Site Reviews
CVE-2024-3050
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-5150 - Login With Phone Number Plugin
The Login with phone number plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.26. This is due to the 'activation_code' default value is empty, and the not empty check is missing in the 'lwp_ajax_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user email. The vulnerability is patched in version 1.7.26, but there is an issue in the patch that causes the entire function…
PLUGIN
Login With Phone Number
CVE-2024-5150
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4544 - Pie Register Plugin
The Pie Register - Social Sites Login (Add on) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.7. This is due to insufficient verification on the user being supplied during a social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
PLUGIN
Pie Register
CVE-2024-4544
Risk Score
Threat Entry
Updated 2025-02-27
CVE-2024-5084 - Hash Form Plugin
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Hash Form
CVE-2024-5084
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3495 - Country State City Auto Dropdown Plugin
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' parameters in versions up to, and including, 2.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Country State City Auto Dropdown
CVE-2024-3495
Risk Score
Threat Entry
Updated 2025-02-05
CVE-2024-5147 - Wpzoom Elementor Addons Plugin
The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.37 via the 'grid_style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
PLUGIN
Wpzoom Elementor Addons
CVE-2024-5147
Risk Score
Threat Entry
Updated 2025-07-07
CVE-2024-4443 - Business Directory Plugin
The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘listingfields’ parameter in all versions up to, and including, 6.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Business Directory
CVE-2024-4443
Risk Score
Threat Entry
Updated 2025-04-18
CVE-2024-4442 - Salon Booking System Plugin
The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 9.8. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
PLUGIN
Salon Booking System
CVE-2024-4442
Risk Score
Threat Entry
Updated 2025-02-06
CVE-2024-2771 - Contact Form Plugin
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's settings and features. This also makes it possible for unauthenticated attackers to delete manager accounts.
PLUGIN
Contact Form
CVE-2024-2771
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-31290 - Demo My WordPress Plugin
Improper Privilege Management vulnerability in CodeRevolution Demo My WordPress allows Privilege Escalation.This issue affects Demo My WordPress: from n/a through 1.0.9.1.
PLUGIN
Demo My WordPress
CVE-2024-31290
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3551 - Penci Soledad Data Migrator Plugin
The Penci Soledad Data Migrator plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.0 via the 'data' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This is limited to just PHP files.
PLUGIN
Penci Soledad Data Migrator
CVE-2024-3551
Risk Score
Threat Entry
Updated 2025-01-24
CVE-2024-4223 - Tutor Lms Plugin
The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete data.
PLUGIN
Tutor Lms
CVE-2024-4223
Risk Score