Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2022-1281 - Photo Gallery Plugin
The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Injection attacks possible.
PLUGIN
Photo Gallery
CVE-2022-1281
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0783 - Multiple Shipping Address Woocommerce Plugin
The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated users, leading to unauthenticated SQL injections
PLUGIN
Multiple Shipping Address Woocommerce
CVE-2022-0783
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0773 - Documentor Plugin
The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement and then executed, leading to an SQL Injection exploitable by unauthenticated users.
PLUGIN
Documentor
CVE-2022-0773
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0771 - Before 5 Plugin
The SiteSuperCharger WordPress plugin before 5.2.0 does not validate, sanitise and escape various user inputs before using them in SQL statements via AJAX actions (available to both unauthenticated and authenticated users), leading to Unauthenticated SQL Injections
PLUGIN
Before 5
CVE-2022-0771
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1391 - Cab Fare Calculator Plugin
The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, which could lead to Local File Inclusion issues.
PLUGIN
Cab Fare Calculator
CVE-2022-1391
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1390 - Admin Word Count Column Plugin
The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique
PLUGIN
Admin Word Count Column
CVE-2022-1390
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0782 - Donations Plugin
The Donations WordPress plugin through 1.8 does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
PLUGIN
Donations
CVE-2022-0782
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0769 - Users Ultra Plugin
The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and authenticated users), leading to an SQL Injection.
PLUGIN
Users Ultra
CVE-2022-0769
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0693 - Master Elements Plugin
The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL Injection
PLUGIN
Master Elements
CVE-2022-0693
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0657 - Before 1 Plugin
The 5 Stars Rating Funnel WordPress Plugin | RRatingg WordPress plugin before 1.2.54 does not properly sanitise, validate and escape lead ids before using them in a SQL statement via the rrtngg_delete_leads AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue. There is an attempt to sanitise the input, using sanitize_text_field(), however such function is not intended to prevent SQL injections.
PLUGIN
Before 1
CVE-2022-0657
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0541 - Flo Launch Plugin
The flo-launch WordPress plugin before 2.4.1 injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate a new site install by setting the flo_custom_table_prefix cookie to an arbitrary value.
PLUGIN
Flo Launch
CVE-2022-0541
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-27862 - Vikbooking Hotel Booking Engine Property Management System Plugin
Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin
PLUGIN
Vikbooking Hotel Booking Engine Property Management System
CVE-2022-27862
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2022-0992 - Security Optimizer Plugin
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized users to configure 2FA for pending accounts. Upon successful configuration, the attacker is logged in as that user without access to a username/password pair which is the expected first form of authentication. This affects versions up to, and including, 1.2.5.
PLUGIN
Security Optimizer
CVE-2022-0992
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1020 - Before 3 Plugin
The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument
PLUGIN
Before 3
CVE-2022-1020
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0785 - Daily Prayer Time Plugin
The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
PLUGIN
Daily Prayer Time
CVE-2022-0785
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0142 - Visual Form Builder Plugin
The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.
PLUGIN
Visual Form Builder
CVE-2022-0142
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0949 - Block Bad Bots And Stop Bad Bots Crawlers And Spiders And Anti Spam Protection Plugin
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection
PLUGIN
Block Bad Bots And Stop Bad Bots Crawlers And Spiders And Anti Spam Protection
CVE-2022-0949
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-1165 - Blackhole For Bad Bots Plugin
The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of requests hitting the blackhole URL, which allows them to be spoofed. This could result in blocking arbitrary IP addresses, such as legitimate/good search engine crawlers / bots. This could also be abused by competitors to cause damage related to visibility in search engines, can be used to bypass arbitrary blocks caused by this plugin, block any visitor or even the administrator and even more.
PLUGIN
Blackhole For Bad Bots
CVE-2022-1165
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0846 - Email Petitions Plugin
The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users
PLUGIN
Email Petitions
CVE-2022-0846
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0787 - Before 5 Plugin
The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users), leading to SQL Injections
PLUGIN
Before 5
CVE-2022-0787
Risk Score