Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-2297 - Profile Builder Plugin
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (wppb_front_end_password_recovery). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-0814, or another vulnerability like SQL Injection in another plugin or theme installed on…
PLUGIN
Profile Builder
CVE-2023-2297
Risk Score
Threat Entry
Updated 2025-02-04
CVE-2023-1020 - Wp Live Chat Shoutbox Plugin
The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
PLUGIN
Wp Live Chat Shoutbox
CVE-2023-1020
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2027 - Zm Ajax Login Register Plugin
The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
PLUGIN
Zm Ajax Login Register
CVE-2023-2027
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-28121 - Woocommerce Payments Plugin
An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.
PLUGIN
Woocommerce Payments
CVE-2023-28121
Risk Score
Threat Entry
Updated 2025-02-11
CVE-2023-1478 - Before 3 Plugin
The Hummingbird WordPress plugin before 3.4.2 does not validate the generated file path for page cache files before writing them, leading to a path traversal vulnerability in the page cache module.
PLUGIN
Before 3
CVE-2023-1478
Risk Score
Threat Entry
Updated 2025-02-25
CVE-2023-28667 - Lead Generated Plugin
The Lead Generated WordPress Plugin, version
PLUGIN
Lead Generated
CVE-2023-28667
Risk Score
Threat Entry
Updated 2025-02-25
CVE-2023-28662 - Gift Vouchers Plugin
The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version
PLUGIN
Gift Vouchers
CVE-2023-28662
Risk Score
Threat Entry
Updated 2025-02-27
CVE-2023-0037 - 10web Map Builder For Google Maps Plugin
The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
PLUGIN
10web Map Builder For Google Maps
CVE-2023-0037
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-26326 - Buddyforms Plugin
The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker could leverage this issue to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.
PLUGIN
Buddyforms
CVE-2023-26326
Risk Score
Threat Entry
Updated 2025-03-12
CVE-2023-0232 - Shoplentor Plugin
The ShopLentor WordPress plugin before 2.5.4 unserializes user input from cookies in order to track viewed products and user data, which could lead to PHP Object Injection.
PLUGIN
Shoplentor
CVE-2023-0232
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-0556 - Contentstudio Plugin
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata (via the function cstu_get_metadata) that includes the plugin's contentstudio_token. Knowing this token allows for other interactions with the plugin such as creating posts in versions prior to 1.2.5, which added other requirements to posting and updating.
PLUGIN
Contentstudio
CVE-2023-0556
Risk Score
Threat Entry
Updated 2025-04-03
CVE-2023-23489 - Easy Digital Downloads Plugin
The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action.
PLUGIN
Easy Digital Downloads
CVE-2023-23489
Risk Score
Threat Entry
Updated 2025-04-03
CVE-2023-23488 - Paid Memberships Pro Plugin
The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route.
PLUGIN
Paid Memberships Pro
CVE-2023-23488
Risk Score
Threat Entry
Updated 2025-04-30
CVE-2021-24649 - Wp User Frontend Plugin
The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This could allow an attacker having access to the AUTH_KEY and AUTH_SALT constant (via an arbitrary file access issue for example, or if the blog is using the default keys) to create an account with any role they want, such as admin
PLUGIN
Wp User Frontend
CVE-2021-24649
Risk Score
Threat Entry
Updated 2025-05-06
CVE-2022-3254 - Wordpress Classifieds Plugin
The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection
PLUGIN
Wordpress Classifieds
CVE-2022-3254
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2022-3708 - Web Stories Plugin
The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
PLUGIN
Web Stories
CVE-2022-3708
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-36898 - Quiz And Survey Master Plugin
Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin
PLUGIN
Quiz And Survey Master
CVE-2021-36898
Risk Score
Threat Entry
Updated 2025-05-07
CVE-2022-3393 - Post To Csv By Bestwebsoft Plugin
The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV injection
PLUGIN
Post To Csv By Bestwebsoft
CVE-2022-3393
Risk Score
Threat Entry
Updated 2025-02-20
CVE-2022-36386 - Wp All Import Plugin
Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin
PLUGIN
Wp All Import
CVE-2022-36386
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-2840 - Zephyr Project Manager Plugin
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
PLUGIN
Zephyr Project Manager
CVE-2022-2840
Risk Score