Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-06-10
CVE-2024-12808 - Before 1 Plugin
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 1
CVE-2024-12808
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-12800 - Ip Based Login Plugin
The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Ip Based Login
CVE-2024-12800
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-12770 - Before 4 Plugin
The WP ULike WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 4
CVE-2024-12770
Risk Score
Threat Entry
Updated 2025-06-10
CVE-2024-12743 - Before 5 Plugin
The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 5
CVE-2024-12743
Risk Score
Threat Entry
Updated 2025-06-09
CVE-2024-12750 - Competition Form Plugin
The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PLUGIN
Competition Form
CVE-2024-12750
Risk Score
Threat Entry
Updated 2025-11-13
CVE-2024-12767 - Buddyboss Platform Plugin
The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts
PLUGIN
Buddyboss Platform
CVE-2024-12767
Risk Score
Threat Entry
Updated 2025-05-22
CVE-2024-12735 - Advance Post Prefix Plugin
The Advance Post Prefix WordPress plugin through 1.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins and above to perform SQL injection attacks
PLUGIN
Advance Post Prefix
CVE-2024-12735
Risk Score
Threat Entry
Updated 2025-05-22
CVE-2024-12734 - Advance Post Prefix Plugin
The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Advance Post Prefix
CVE-2024-12734
Risk Score
Threat Entry
Updated 2025-05-22
CVE-2024-12733 - Through 1 Plugin
The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Through 1
CVE-2024-12733
Risk Score
Threat Entry
Updated 2025-05-22
CVE-2024-12732 - Through 1 Plugin
The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Through 1
CVE-2024-12732
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2024-12726 - Through 0 Plugin
The ClipArt WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Through 0
CVE-2024-12726
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2024-12725 - Clasify Classified Listing Plugin
The Clasify Classified Listing WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Clasify Classified Listing
CVE-2024-12725
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2024-12724 - Through 1 Plugin
The WP DeskLite WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Through 1
CVE-2024-12724
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2024-12722 - Twitter Bootstrap Collapse Aka Accordian Shortcode Plugin
The Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Twitter Bootstrap Collapse Aka Accordian Shortcode
CVE-2024-12722
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2024-12739 - Mobile Contact Bar Plugin
The Mobile Contact Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Mobile Contact Bar
CVE-2024-12739
Risk Score
Threat Entry
Updated 2025-06-11
CVE-2024-12716 - Before 20250114 Does Not Sanitise And Escape Some Of Its Settings Plugin
The Simple Basic Contact Form WordPress plugin before 20250114 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 20250114 Does Not Sanitise And Escape Some Of Its Settings
CVE-2024-12716
Risk Score
Threat Entry
Updated 2025-05-28
CVE-2024-12680 - Before 1 Plugin
The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 1
CVE-2024-12680
Risk Score
Threat Entry
Updated 2025-06-09
CVE-2024-11372 - Connexion Logs Plugin
The Connexion Logs WordPress plugin through 3.0.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
PLUGIN
Connexion Logs
CVE-2024-11372
Risk Score
Threat Entry
Updated 2025-06-09
CVE-2024-12301 - Jsp Store Locator Plugin
The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.
PLUGIN
Jsp Store Locator
CVE-2024-12301
Risk Score
Threat Entry
Updated 2025-06-09
CVE-2024-12282 - Through 2 Plugin
The WordPress连接微博 WordPress plugin through 2.5.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
PLUGIN
Through 2
CVE-2024-12282
Risk Score