Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2023-35909 - Ninja Forms Plugin
Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This issue affects Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress: from n/a through 3.6.25.
PLUGIN
Ninja Forms
CVE-2023-35909
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5714 - System Dashboard Plugin
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve data key specs.
PLUGIN
System Dashboard
CVE-2023-5714
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5713 - System Dashboard Plugin
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve potentially sensitive option values, and deserialize the content of those values.
PLUGIN
System Dashboard
CVE-2023-5713
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5712 - System Dashboard Plugin
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive global value information.
PLUGIN
System Dashboard
CVE-2023-5712
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5711 - System Dashboard Plugin
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information provided by PHP info.
PLUGIN
System Dashboard
CVE-2023-5711
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5710 - System Dashboard Plugin
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information such as database credentials.
PLUGIN
System Dashboard
CVE-2023-5710
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6527 - Email Subscription Popup Plugin
The Email Subscription Popup plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the HTTP_REFERER header in all versions up to, and including, 1.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Email Subscription Popup
CVE-2023-6527
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5990 - Before 3 Plugin
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on some of its form actions such as deletion and duplication, which could allow attackers to make logged in admin perform such actions via CSRF attacks
PLUGIN
Before 3
CVE-2023-5990
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5979 - Ecommerce Product Catalog Plugin
The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as delete all products
PLUGIN
Ecommerce Product Catalog
CVE-2023-5979
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5884 - Word Balloon Plugin
The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.
PLUGIN
Word Balloon
CVE-2023-5884
Risk Score
Threat Entry
Updated 2025-02-20
CVE-2023-5951 - Welcart E Commerce Plugin
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Welcart E Commerce
CVE-2023-5951
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5105 - Frontend File Manager Plugin
The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass the file download logic and download files such as `wp-config.php`
PLUGIN
Frontend File Manager
CVE-2023-5105
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5210 - Amp Plus Plugin
The AMP+ Plus WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Amp Plus
CVE-2023-5210
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5141 - Bsk Contact Form 7 Blacklist Plugin
The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the inserted_count parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Bsk Contact Form 7 Blacklist
CVE-2023-5141
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-4460 - Uploading Svg Webp And Ico Files Plugin
The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
PLUGIN
Uploading Svg Webp And Ico Files
CVE-2023-4460
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5874 - Before 3 Plugin
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 3
CVE-2023-5874
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-5809 - Before 3 Plugin
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 3
CVE-2023-5809
Risk Score
Threat Entry
Updated 2025-05-29
CVE-2023-5137 - Simply Excerpts Plugin
The Simply Excerpts WordPress plugin through 1.4 does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
PLUGIN
Simply Excerpts
CVE-2023-5137
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-6449 - Contact Form 7 Plugin
The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7_antiscript_file_name' function in versions up to, and including, 5.8.3. This makes it possible for authenticated attackers with editor-level capabilities or above to upload arbitrary files on the affected site's server, but due to the htaccess configuration, remote code cannot be executed in most cases. By default, the file will be deleted from the server immediately. However, in some cases, other plugins may…
PLUGIN
Contact Form 7
CVE-2023-6449
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-48754 - Delete Post Revisions Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Wap Nepal Delete Post Revisions In WordPress allows Cross Site Request Forgery.This issue affects Delete Post Revisions In WordPress: from n/a through 4.6.
PLUGIN
Delete Post Revisions
CVE-2023-48754
Risk Score