Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-10-15
CVE-2024-9581 - Shortcodes Anywhere Plugin
The Shortcodes AnyWhere plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
PLUGIN
Shortcodes Anywhere
CVE-2024-9581
Risk Score
Threat Entry
Updated 2024-10-15
CVE-2024-9519 - Userplus Plugin
The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'save_metabox_form' function in versions up to, and including, 2.0. This makes it possible for authenticated attackers, with editor-level permissions or above, to update the registration form role to administrator, which leads to privilege escalation.
PLUGIN
Userplus
CVE-2024-9519
Risk Score
Threat Entry
Updated 2024-10-10
CVE-2024-47334 - WordPress Core
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Flow Zoho Flow for WordPress allows SQL Injection.This issue affects Zoho Flow for WordPress: from n/a through 2.7.1.
CORE
WordPress Core
CVE-2024-47334
Risk Score
Threat Entry
Updated 2025-01-09
CVE-2024-9575 - Pretix Widget On Windows Allows Php Local File Inclusion Plugin
Local File Inclusion vulnerability in pretix Widget WordPress plugin pretix-widget on Windows allows PHP Local File Inclusion. This issue affects pretix Widget WordPress plugin: from 1.0.0 through 1.0.5.
PLUGIN
Pretix Widget On Windows Allows Php Local File Inclusion
CVE-2024-9575
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-47327 - WordPress Core
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eyal Fitoussi GEO my WordPress allows Reflected XSS.This issue affects GEO my WordPress: from n/a through 4.5.0.3.
CORE
WordPress Core
CVE-2024-47327
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-47386 - WordPress Core
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended allows Reflected XSS.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.0.8.
CORE
WordPress Core
CVE-2024-47386
Risk Score
Threat Entry
Updated 2026-02-20
CVE-2024-47638 - Online Booking Scheduling Calendar Plugin
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita Online Booking & Scheduling Calendar for WordPress by vcita allows Reflected XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.4.6.
PLUGIN
Online Booking Scheduling Calendar
CVE-2024-47638
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-44018 - WordPress Core
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Istmo Plugins Instant Chat Floating Button for WordPress Websites allows PHP Local File Inclusion.This issue affects Instant Chat Floating Button for WordPress Websites: from n/a through 1.0.5.
CORE
WordPress Core
CVE-2024-44018
Risk Score
Threat Entry
Updated 2025-01-29
CVE-2024-9314 - Seo Plugin
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.228 via deserialization of untrusted input 'set_redirections' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve…
PLUGIN
Seo
CVE-2024-9314
Risk Score
Threat Entry
Updated 2024-10-08
CVE-2024-8352 - Social Web Suite Plugin
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the download_log function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
PLUGIN
Social Web Suite
CVE-2024-8352
Risk Score
Threat Entry
Updated 2025-05-16
CVE-2024-7315 - Before 0 Plugin
The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when generating a backup, which could be bruteforced by attackers to leak sensitive information about said backups.
PLUGIN
Before 0
CVE-2024-7315
Risk Score
Threat Entry
Updated 2025-02-11
CVE-2024-7855 - Wp Hotel Booking Plugin
The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() function in all versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Wp Hotel Booking
CVE-2024-7855
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-9018 - Wp Easy Gallery Plugin
The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘key’ parameter in all versions up to, and including, 4.8.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Wp Easy Gallery
CVE-2024-9018
Risk Score
Threat Entry
Updated 2025-02-10
CVE-2024-8548 - Kb Support Plugin
The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in all versions up to, and including, 1.6.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform multiple administrative actions, such as replying to arbitrary tickets, updating the status of any post, deleting any post, adding notes to tickets, flagging or unflagging tickets, and adding or removing ticket participants.
PLUGIN
Kb Support
CVE-2024-8548
Risk Score
Threat Entry
Updated 2024-10-04
CVE-2024-7869 - 123 Chat Videochat Plugin
The 123.chat - Video Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
123 Chat Videochat
CVE-2024-7869
Risk Score
Threat Entry
Updated 2024-11-13
CVE-2024-7434 - Ultrapress Plugin
The UltraPress theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
PLUGIN
Ultrapress
CVE-2024-7434
Risk Score
Threat Entry
Updated 2024-11-13
CVE-2024-7433 - Empowerment Plugin
The Empowerment theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.2 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
PLUGIN
Empowerment
CVE-2024-7433
Risk Score
Threat Entry
Updated 2024-11-13
CVE-2024-7432 - Unseen Blog Plugin
The Unseen Blog theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
PLUGIN
Unseen Blog
CVE-2024-7432
Risk Score
Threat Entry
Updated 2024-10-04
CVE-2024-8981 - Broken Link Checker Plugin
The Broken Link Checker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg in /app/admin-notices/features/class-view.php without appropriate escaping on the URL in all versions up to, and including, 2.4.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Broken Link Checker
CVE-2024-8981
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-8379 - Cost Calculator Builder Plugin
The Cost Calculator Builder WordPress plugin before 3.2.29 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
PLUGIN
Cost Calculator Builder
CVE-2024-8379
Risk Score