Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-01-15
CVE-2023-4729 - Ladipage Plugin
The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the publish_lp() function hooked via an AJAX action in versions up to, and including, 4.4. This makes it possible for unauthenticated attackers to change the LadiPage key (a key fully controlled by the attacker), enabling them to freely create new pages, including web pages that trigger stored XSS via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Ladipage
CVE-2023-4729
Risk Score
Threat Entry
Updated 2025-01-15
CVE-2023-4728 - Ladipage Plugin
The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the publish_lp() function hooked via an AJAX action in versions up to, and including, 4.4. This makes it possible for authenticated attackers with subscriber-level access and above to change the LadiPage key (a key fully controlled by the attacker), enabling them to freely create new pages, including web pages that trigger stored XSS
PLUGIN
Ladipage
CVE-2023-4728
Risk Score
Threat Entry
Updated 2025-01-15
CVE-2023-4629 - Ladipage Plugin
The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the save_config() function in versions up to, and including, 4.3. This makes it possible for unauthenticated attackers to update the 'ladipage_config' option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Ladipage
CVE-2023-4629
Risk Score
Threat Entry
Updated 2025-01-15
CVE-2023-4628 - Ladipage Plugin
The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the ladiflow_save_hook() function in versions up to, and including, 4.4. This makes it possible for unauthenticated attackers to update the 'ladiflow_hook_configs' option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Ladipage
CVE-2023-4628
Risk Score
Threat Entry
Updated 2025-01-15
CVE-2023-4627 - Ladipage Plugin
The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_config() function in versions up to, and including, 4.4. This makes it possible for authenticated attackers with subscriber-level access and above to update the 'ladipage_config' option.
PLUGIN
Ladipage
CVE-2023-4627
Risk Score
Threat Entry
Updated 2025-01-21
CVE-2023-4626 - Ladipage Plugin
The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ladiflow_save_hook() function in versions up to, and including, 4.3. This makes it possible for authenticated attackers with subscriber-level access and above to update the 'ladiflow_hook_configs' option.
PLUGIN
Ladipage
CVE-2023-4626
Risk Score
Threat Entry
Updated 2025-03-13
CVE-2024-1328 - Newsletter2go Plugin
The Newsletter2Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and including, 4.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Newsletter2go
CVE-2024-1328
Risk Score
Threat Entry
Updated 2025-03-13
CVE-2024-0906 - F X Private Site Plugin
The f(x) Private Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the API. This makes it possible for unauthenticated attackers to obtain page and post contents of a site protected with this plugin.
PLUGIN
F X Private Site
CVE-2024-0906
Risk Score
Threat Entry
Updated 2025-01-21
CVE-2024-1645 - Mollie Forms Plugin
The Mollie Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportRegistrations function in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with subscriber access or higher, to export payment data collected by this plugin.
PLUGIN
Mollie Forms
CVE-2024-1645
Risk Score
Threat Entry
Updated 2025-02-05
CVE-2024-1400 - Mollie Forms Plugin
The Mollie Forms plugin for WordPress is vulnerable to unauthorized post or page duplication due to a missing capability check on the duplicateForm function in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with subscriber access or higher, to duplicate arbitrary posts and pages.
PLUGIN
Mollie Forms
CVE-2024-1400
Risk Score
Threat Entry
Updated 2025-05-09
CVE-2024-1290 - User Registration Plugin
The User Registration WordPress plugin before 2.12 does not prevent users with at least the contributor role from rendering sensitive shortcodes, allowing them to generate, and leak, valid password reset URLs, which they can use to take over any accounts.
PLUGIN
User Registration
CVE-2024-1290
Risk Score
Threat Entry
Updated 2025-04-01
CVE-2024-1487 - Photos And Files Contest Gallery Plugin
The Photos and Files Contest Gallery WordPress plugin before 21.3.1 does not sanitize and escape some parameters, which could allow users with a role as low as author to perform Cross-Site Scripting attacks.
PLUGIN
Photos And Files Contest Gallery
CVE-2024-1487
Risk Score
Threat Entry
Updated 2025-04-01
CVE-2024-0559 - Enhanced Text Widget Plugin
The Enhanced Text Widget WordPress plugin before 1.6.6 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Enhanced Text Widget
CVE-2024-0559
Risk Score
Threat Entry
Updated 2025-05-01
CVE-2024-1273 - Before 3 Plugin
The Starbox WordPress plugin before 3.5.0 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
PLUGIN
Before 3
CVE-2024-1273
Risk Score
Threat Entry
Updated 2025-05-01
CVE-2024-0561 - Ultimate Posts Widget Plugin
The Ultimate Posts Widget WordPress plugin before 2.3.1 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Ultimate Posts Widget
CVE-2024-0561
Risk Score
Threat Entry
Updated 2025-05-01
CVE-2023-6444 - Seriously Simple Podcasting Plugin
The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted request.
PLUGIN
Seriously Simple Podcasting
CVE-2023-6444
Risk Score
Threat Entry
Updated 2025-05-01
CVE-2023-7247 - Login As User Or Customer User Switching Plugin
The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.
PLUGIN
Login As User Or Customer User Switching
CVE-2023-7247
Risk Score
Threat Entry
Updated 2025-03-28
CVE-2024-1279 - Paid Memberships Pro Plugin
The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata.
PLUGIN
Paid Memberships Pro
CVE-2024-1279
Risk Score
Threat Entry
Updated 2025-01-28
CVE-2024-1870 - Colibri Page Builder Plugin
The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callActivateLicenseEndpoint function in all versions up to, and including, 1.0.260. This makes it possible for authenticated attackers, with subscriber access or higher, to update the license key.
PLUGIN
Colibri Page Builder
CVE-2024-1870
Risk Score
Threat Entry
Updated 2025-02-04
CVE-2024-1767 - Blocksy Plugin
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 2.0.26 due to insufficient input sanitization and output escaping on user supplied attributes like 'className' and 'radius'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Blocksy
CVE-2024-1767
Risk Score