Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-08-15
CVE-2025-8867 - Graphina Elementor Charts And Graphs Plugin
The Graphina - Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widget parameters in version 3.1.3 and below. This is due to insufficient input sanitization and output escaping on user supplied attributes such as chart categories, titles, and tooltip settings. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Graphina Elementor Charts And Graphs
CVE-2025-8867
Risk Score
Threat Entry
Updated 2025-08-15
CVE-2025-8680 - B Slider Plugin
The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Server-Side Request Forgery in version less than, or equal to, 2.0.0 via the fs_api_request function. This makes it possible for authenticated attackers, with subscriber-level access and above to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
PLUGIN
B Slider
CVE-2025-8680
Risk Score
Threat Entry
Updated 2025-08-15
CVE-2025-8676 - B Slider Plugin
The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in versions less than, or equal to, 2.0.0 via the get_active_plugins function. This makes it possible for authenticated attackers, with subscriber-level access and above to extract sensitive data including installed plugin information.
PLUGIN
B Slider
CVE-2025-8676
Risk Score
Threat Entry
Updated 2025-08-15
CVE-2025-8342 - Login With Phone Number Plugin
The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value checking in the lwp_ajax_register function in all versions up to, and including, 1.8.47. This makes it possible for unauthenticated attackers to bypass OTP verification and gain administrative access to any user account with a configured phone number by exploiting improper Firebase API error handling when the Firebase API key is not configured.
PLUGIN
Login With Phone Number
CVE-2025-8342
Risk Score
Threat Entry
Updated 2025-08-15
CVE-2025-6025 - Order Tip Woo Plugin
The Order Tip for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Improper Input Validation in all versions up to, and including, 1.5.4. This is due to lack of server-side validation on the `data-tip` attribute, which makes it possible for unauthenticated attackers to apply an excessive or even negative tip amount, resulting in unauthorized discount up to free orders depending on the value submitted.
PLUGIN
Order Tip Woo
CVE-2025-6025
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-54676 - Online Booking Scheduling Calendar Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita allows Stored XSS. This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.5.3.
PLUGIN
Online Booking Scheduling Calendar
CVE-2025-54676
Risk Score
Threat Entry
Updated 2025-08-14
CVE-2025-52731 - WordPress Core
Missing Authorization vulnerability in themefunction WordPress Event Manager, Event Calendar and Booking Plugin allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WordPress Event Manager, Event Calendar and Booking Plugin: from n/a through 4.0.24.
CORE
WordPress Core
CVE-2025-52731
Risk Score
Threat Entry
Updated 2025-08-14
CVE-2025-52728 - Allows Php Local File Inclusion Plugin
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace Responsive Posts Carousel WordPress Plugin allows PHP Local File Inclusion. This issue affects Responsive Posts Carousel WordPress Plugin: from n/a through 15.0.
PLUGIN
Allows Php Local File Inclusion
CVE-2025-52728
Risk Score
Threat Entry
Updated 2025-08-14
CVE-2025-52730 - WordPress Core
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themefunction WordPress Event Manager, Event Calendar and Booking Plugin allows Stored XSS. This issue affects WordPress Event Manager, Event Calendar and Booking Plugin: from n/a through 4.0.24.
CORE
WordPress Core
CVE-2025-52730
Risk Score
Threat Entry
Updated 2025-08-14
CVE-2025-28975 - WordPress Core
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redqteam Alike - WordPress Custom Post Comparison allows Reflected XSS. This issue affects Alike - WordPress Custom Post Comparison: from n/a through 3.0.1.
CORE
WordPress Core
CVE-2025-28975
Risk Score
Threat Entry
Updated 2025-08-14
CVE-2025-8047 - WordPress Core
The disable-right-click-powered-by-pixterme through v1.2 and pixter-image-digital-license thtough v1.0 WordPress plugins load a JavaScript file which has been compromised from an apparent abandoned S3 bucket. It can be used as a backdoor by those who control it, but it currently displays an alert marketing security services. Users that pay are added to allowedDomains to suppress the popup.
CORE
WordPress Core
CVE-2025-8047
Risk Score
Threat Entry
Updated 2025-08-18
CVE-2025-5998 - Password Protect Wordpress Plugin
The PPWP – Password Protect Pages WordPress plugin before version 1.9.11 allows to put the site content behind a password authorization, however users with subscriber or greater roles can view content via the REST API.
PLUGIN
Password Protect Wordpress
CVE-2025-5998
Risk Score
Threat Entry
Updated 2026-01-16
CVE-2025-8046 - Injection Guard Plugin
The Injection Guard WordPress plugin before 1.2.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
PLUGIN
Injection Guard
CVE-2025-8046
Risk Score
Threat Entry
Updated 2026-02-20
CVE-2025-7808 - Before 1 Plugin
The WP Shopify WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 1
CVE-2025-7808
Risk Score
Threat Entry
Updated 2025-08-14
CVE-2025-6790 - Before 10 Plugin
The Quiz and Survey Master (QSM) WordPress plugin before 10.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
PLUGIN
Before 10
CVE-2025-6790
Risk Score
Threat Entry
Updated 2025-08-14
CVE-2025-3414 - Before 1 Plugin
The Structured Content (JSON-LD) #wpsc WordPress plugin before 1.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 1
CVE-2025-3414
Risk Score
Threat Entry
Updated 2025-08-13
CVE-2025-6184 - Tutor Plugin
The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter used in the get_submitted_assignments() function in all versions up to, and including, 3.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Tutor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only the Pro…
PLUGIN
Tutor
CVE-2025-6184
Risk Score
Threat Entry
Updated 2025-08-13
CVE-2025-6715 - Before 5 Plugin
The LatePoint WordPress plugin before 5.1.94 is vulnerable to Local File Inclusion via the layout parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
PLUGIN
Before 5
CVE-2025-6715
Risk Score
Threat Entry
Updated 2025-08-13
CVE-2025-7384 - Contact Form Entries Plugin
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted input in the get_lead_detail function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.
PLUGIN
Contact Form Entries
CVE-2025-7384
Risk Score
Threat Entry
Updated 2025-12-18
CVE-2025-8891 - Oceanwp Plugin
The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect nonce validation on the oceanwp_notice_button_click() function. This makes it possible for unauthenticated attackers to install the Ocean Extra plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Oceanwp
CVE-2025-8891
Risk Score