Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-05-13
CVE-2024-1846 - Responsive Tabs Plugin
The Responsive Tabs WordPress plugin before 4.0.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Responsive Tabs
CVE-2024-1846
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-2858 - Simple Buttons Creator Plugin
The Simple Buttons Creator WordPress plugin through 1.04 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
PLUGIN
Simple Buttons Creator
CVE-2024-2858
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-2836 - Social Login And Social Comments Plugin
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.64 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Social Login And Social Comments
CVE-2024-2836
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-1754 - Nps Computy Plugin
The NPS computy WordPress plugin through 2.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Nps Computy
CVE-2024-1754
Risk Score
Threat Entry
Updated 2025-04-08
CVE-2024-1307 - Before 2 Plugin
The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as low as a subscriber to call them and perform unauthorized actions
PLUGIN
Before 2
CVE-2024-1307
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2023-7201 - Everest Backup Plugin
The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
PLUGIN
Everest Backup
CVE-2023-7201
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-1746 - Testimonial Slider Plugin
The Testimonial Slider WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Testimonial Slider
CVE-2024-1746
Risk Score
Threat Entry
Updated 2025-04-08
CVE-2024-1306 - Before 2 Plugin
The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk.
PLUGIN
Before 2
CVE-2024-1306
Risk Score
Threat Entry
Updated 2025-05-27
CVE-2024-1310 - Before 8 Plugin
The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products)
PLUGIN
Before 8
CVE-2024-1310
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-1660 - Before 3 Plugin
The Top Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 3
CVE-2024-1660
Risk Score
Threat Entry
Updated 2025-04-07
CVE-2024-0902 - Before 6 Plugin
The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 6
CVE-2024-0902
Risk Score
Threat Entry
Updated 2025-04-08
CVE-2024-1712 - Carousel Slider Plugin
The Carousel Slider WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Carousel Slider
CVE-2024-1712
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-1204 - Before 5 Plugin
The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts.
PLUGIN
Before 5
CVE-2024-1204
Risk Score
Threat Entry
Updated 2025-05-09
CVE-2023-6067 - Wp User Profile Avatar Plugin
The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Wp User Profile Avatar
CVE-2023-6067
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3662 - WPZOOM Social Feed Widget & Block Plugin
The WPZOOM Social Feed Widget & Block plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpzoom_instagram_clear_data() function in all versions up to, and including, 2.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all Instagram images installed on the site.
PLUGIN
WPZOOM Social Feed Widget & Block
CVE-2024-3662
Risk Score
Threat Entry
Updated 2025-06-17
CVE-2023-6494 - Wpc Smart Quick View For Woocommerce Plugin
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Wpc Smart Quick View For Woocommerce
CVE-2023-6494
Risk Score
Threat Entry
Updated 2025-05-12
CVE-2024-2583 - Shortcodes Ultimate Plugin
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible for users with the contributor role to conduct Stored XSS attacks.
PLUGIN
Shortcodes Ultimate
CVE-2024-2583
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3027 - Smart Slider 3 Plugin
The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all versions up to, and including, 3.5.1.22. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files, including SVG files, which can be used to conduct stored cross-site scripting attacks.
PLUGIN
Smart Slider 3
CVE-2024-3027
Risk Score
Threat Entry
Updated 2025-02-27
CVE-2024-1957 - Givewp Plugin
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Givewp
CVE-2024-1957
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-31235 - WordPress Comments Import & Export Plugin
Cross-Site Request Forgery (CSRF) vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.5.
PLUGIN
WordPress Comments Import & Export
CVE-2024-31235
Risk Score