Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-05-28
CVE-2024-13486 - Icegram Engage Plugin
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Icegram Engage
CVE-2024-13486
Risk Score
Threat Entry
Updated 2025-05-28
CVE-2024-13482 - Icegram Engage Plugin
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Icegram Engage
CVE-2024-13482
Risk Score
Threat Entry
Updated 2025-06-05
CVE-2024-13384 - Slider In Rbs Image Gallery Plugin
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Slider In Rbs Image Gallery
CVE-2024-13384
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-13383 - Before 2 Plugin
The HD Quiz WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 2
CVE-2024-13383
Risk Score
Threat Entry
Updated 2025-05-23
CVE-2024-13382 - Before 5 Plugin
The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 5
CVE-2024-13382
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-13357 - Before 3 Plugin
The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 3
CVE-2024-13357
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-13313 - Through 7 Plugin
The AWeber WordPress plugin through 7.3.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Through 7
CVE-2024-13313
Risk Score
Threat Entry
Updated 2025-05-22
CVE-2024-13128 - Before 4 Plugin
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 4
CVE-2024-13128
Risk Score
Threat Entry
Updated 2025-05-22
CVE-2024-13127 - Before 4 Plugin
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 4
CVE-2024-13127
Risk Score
Threat Entry
Updated 2025-06-09
CVE-2024-13053 - Form Maker By 10web Plugin
The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Form Maker By 10web
CVE-2024-13053
Risk Score
Threat Entry
Updated 2025-06-09
CVE-2024-12873 - Custom Field Manager Plugin
The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Custom Field Manager
CVE-2024-12873
Risk Score
Threat Entry
Updated 2025-06-09
CVE-2024-12874 - Top Comments Plugin
The Top Comments WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Top Comments
CVE-2024-12874
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-12808 - Before 1 Plugin
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 1
CVE-2024-12808
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-12800 - Ip Based Login Plugin
The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Ip Based Login
CVE-2024-12800
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-12770 - Before 4 Plugin
The WP ULike WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 4
CVE-2024-12770
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-12743 - Before 5 Plugin
The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 5
CVE-2024-12743
Risk Score
Threat Entry
Updated 2025-06-09
CVE-2024-12750 - Competition Form Plugin
The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PLUGIN
Competition Form
CVE-2024-12750
Risk Score
Threat Entry
Updated 2025-05-22
CVE-2024-12734 - Advance Post Prefix Plugin
The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Advance Post Prefix
CVE-2024-12734
Risk Score
Threat Entry
Updated 2025-05-22
CVE-2024-12733 - Through 1 Plugin
The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Through 1
CVE-2024-12733
Risk Score
Threat Entry
Updated 2025-05-22
CVE-2024-12732 - Through 1 Plugin
The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Through 1
CVE-2024-12732
Risk Score