Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2024-3682 - WP STAGING Pro WordPress Backup Plugin
The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions up to, and including, 5.4.3, respectively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extract sensitive data from a log file, including system information and (in the Pro version) license keys. Successful exploitation requires an administrator to have used the 'Contact Us' functionality along with the "Enable this option to automatically submit the log files." option.
PLUGIN
WP STAGING Pro WordPress Backup Plugin
CVE-2024-3682
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-3890 - Happy Addons For Elementor Plugin
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Calendly widget in all versions up to, and including, 3.10.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Happy Addons For Elementor
CVE-2024-3890
Risk Score
Threat Entry
Updated 2025-06-05
CVE-2024-3678 - Blog2social Plugin
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2. This makes it possible for unauthenticated attackers to view limited information from password protected posts.
PLUGIN
Blog2social
CVE-2024-3678
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2920 - WP-Members Membership Plugin
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 due to the plugin uploading user supplied files to a publicly accessible directory in wp-content without any restrictions. This makes it possible for unauthenticated attackers to view files uploaded by other users which may contain sensitive information.
PLUGIN
WP-Members Membership Plugin
CVE-2024-2920
Risk Score
Threat Entry
Updated 2025-05-14
CVE-2024-3188 - Shortcodes Ultimate Plugin
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Shortcodes Ultimate
CVE-2024-3188
Risk Score
Threat Entry
Updated 2025-04-18
CVE-2024-2603 - Salon Booking System Plugin
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin (or editor depending on Salon booking system WordPress plugin through 9.6.5 configuration) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Salon Booking System
CVE-2024-2603
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-2310 - Wp Google Review Slider Plugin
The WP Google Review Slider WordPress plugin before 13.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Wp Google Review Slider
CVE-2024-2310
Risk Score
Threat Entry
Updated 2025-05-07
CVE-2024-3059 - Enl Newsletter Plugin
The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack
PLUGIN
Enl Newsletter
CVE-2024-3059
Risk Score
Threat Entry
Updated 2025-05-14
CVE-2024-3048 - Bannerlid Plugin
The Bannerlid WordPress plugin through 1.1.0 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators
PLUGIN
Bannerlid
CVE-2024-3048
Risk Score
Threat Entry
Updated 2025-05-07
CVE-2024-3058 - Enl Newsletter Plugin
The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
PLUGIN
Enl Newsletter
CVE-2024-3058
Risk Score
Threat Entry
Updated 2025-04-14
CVE-2024-2837 - Before 3 Plugin
The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Before 3
CVE-2024-2837
Risk Score
Threat Entry
Updated 2025-04-14
CVE-2024-2439 - Salon Booking System Plugin
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Salon Booking System
CVE-2024-2439
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-2159 - Social Sharing Plugin
The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Social Sharing
CVE-2024-2159
Risk Score
Threat Entry
Updated 2025-05-07
CVE-2024-3060 - Enl Newsletter Plugin
The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks
PLUGIN
Enl Newsletter
CVE-2024-3060
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-2908 - Call Now Button Plugin
The Call Now Button WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Call Now Button
CVE-2024-2908
Risk Score
Threat Entry
Updated 2025-04-14
CVE-2024-2429 - Salon Booking System Plugin
The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PLUGIN
Salon Booking System
CVE-2024-2429
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-0905 - Fancy Product Designer Plugin
The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against unauthenticated and admin-level users
PLUGIN
Fancy Product Designer
CVE-2024-0905
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-3265 - Advance Search Plugin
The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administrator role to conduct SQL Injection attacks in the context of a multisite WordPress configurations.
PLUGIN
Advance Search
CVE-2024-3265
Risk Score
Threat Entry
Updated 2025-02-05
CVE-2024-3730 - Simple Membership Plugin
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Simple Membership
CVE-2024-3730
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4035 - photo_gallery Theme
The Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 2.7.7.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
photo_gallery
CVE-2024-4035
Risk Score