Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-02-07
CVE-2024-2475 - Media Library Assistant Plugin
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Media Library Assistant
CVE-2024-2475
Risk Score
Threat Entry
Updated 2025-04-01
CVE-2024-0673 - Pz Linkcard Plugin
The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Pz Linkcard
CVE-2024-0673
Risk Score
Threat Entry
Updated 2025-04-01
CVE-2024-0677 - Pz Linkcard Plugin
The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.
PLUGIN
Pz Linkcard
CVE-2024-0677
Risk Score
Threat Entry
Updated 2025-01-17
CVE-2024-2091 - Elementor Addon Elements Plugin
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.13.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Elementor Addon Elements
CVE-2024-2091
Risk Score
Threat Entry
Updated 2025-01-08
CVE-2024-2111 - Events Manager Plugin
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the physical location value in all versions up to, and including, 6.4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Events Manager
CVE-2024-2111
Risk Score
Threat Entry
Updated 2025-01-08
CVE-2024-2110 - Events Manager Plugin
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.7.1. This is due to missing or incorrect nonce validation on several actions. This makes it possible for unauthenticated attackers to modify booking statuses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Events Manager
CVE-2024-2110
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-29765 - Aparat for WordPress Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alireza Sedghi Aparat for WordPress allows Stored XSS.This issue affects Aparat for WordPress: from n/a through 2.2.0.
PLUGIN
Aparat for WordPress
CVE-2024-29765
Risk Score
Threat Entry
Updated 2025-05-13
CVE-2024-29804 - Fancy Comments Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Heateor Fancy Comments WordPress allows Stored XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.14.
PLUGIN
Fancy Comments
CVE-2024-29804
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-29771 - This Issue Affects Dracula Dark Mode The Revolutionary Dark Mode Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoftLab Dracula Dark Mode - The Revolutionary Dark Mode Plugin For WordPress allows Stored XSS.This issue affects Dracula Dark Mode - The Revolutionary Dark Mode Plugin For WordPress: from n/a through 1.0.8.
PLUGIN
This Issue Affects Dracula Dark Mode The Revolutionary Dark Mode
CVE-2024-29771
Risk Score
Threat Entry
Updated 2025-03-05
CVE-2024-29932 - Wordpress Meta Data And Taxonomies Filter Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Stored XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.2.
PLUGIN
Wordpress Meta Data And Taxonomies Filter
CVE-2024-29932
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2962 - Networker - Tech News WordPress Theme with Dark Mode
The Networker - Tech News WordPress Theme with Dark Mode theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_reload_nav_menu() function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to modify the location of display menus.
THEME
Networker - Tech News WordPress Theme with Dark Mode
CVE-2024-2962
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2956 - Simple Ajax Chat – Add a Fast, Secure Chat Box Plugin
The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 20231101 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Simple Ajax Chat – Add a Fast, Secure Chat Box
CVE-2024-2956
Risk Score
Threat Entry
Updated 2025-03-12
CVE-2024-2781 - Elementor Pro Plugin
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the video_html_tag attribute in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Elementor Pro
CVE-2024-2781
Risk Score
Threat Entry
Updated 2025-03-12
CVE-2024-2121 - Elementor Pro Plugin
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Carousel widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Elementor Pro
CVE-2024-2121
Risk Score
Threat Entry
Updated 2025-01-28
CVE-2024-2120 - Website Builder Plugin
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Navigation widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Website Builder
CVE-2024-2120
Risk Score
Threat Entry
Updated 2025-03-05
CVE-2024-29906 - Wordpress Meta Data And Taxonomies Filter Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Stored XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.2.
PLUGIN
Wordpress Meta Data And Taxonomies Filter
CVE-2024-29906
Risk Score
Threat Entry
Updated 2025-03-12
CVE-2024-1521 - Elementor Pro Plugin
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an SVGZ file uploaded via the Form widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability is only exploitable on web servers running NGINX. It is not exploitable on web servers running Apache HTTP Server.
PLUGIN
Elementor Pro
CVE-2024-1521
Risk Score
Threat Entry
Updated 2025-03-12
CVE-2024-1364 - Elementor Pro Plugin
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget's custom_id in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Elementor Pro
CVE-2024-1364
Risk Score
Threat Entry
Updated 2025-01-28
CVE-2024-2210 - The Plus Addons For Elementor Plugin
The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Team Member Listing widget. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
PLUGIN
The Plus Addons For Elementor
CVE-2024-2210
Risk Score
Threat Entry
Updated 2025-01-28
CVE-2024-2203 - The Plus Addons For Elementor Plugin
The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Clients widget. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
PLUGIN
The Plus Addons For Elementor
CVE-2024-2203
Risk Score