Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-05-14
CVE-2024-13306 - Maps Plugin Using Google Maps For Wordpress
The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Maps Plugin Using Google Maps For Wordpress
CVE-2024-13306
Risk Score
Threat Entry
Updated 2025-05-14
CVE-2024-13208 - Maps Plugin Using Google Maps For Wordpress
The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Maps Plugin Using Google Maps For Wordpress
CVE-2024-13208
Risk Score
Threat Entry
Updated 2025-02-14
CVE-2025-23657 - WordPress-to-candidate for Salesforce CRM Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WordPress-to-candidate for Salesforce CRM allows Reflected XSS. This issue affects WordPress-to-candidate for Salesforce CRM: from n/a through 1.0.1.
PLUGIN
WordPress-to-candidate for Salesforce CRM
CVE-2025-23657
Risk Score
Threat Entry
Updated 2025-02-14
CVE-2025-23492 - WordPress 淘宝客插件 Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CantonBolo WordPress 淘宝客插件 allows Reflected XSS. This issue affects WordPress 淘宝客插件: from n/a through 1.1.2.
PLUGIN
WordPress 淘宝客插件
CVE-2025-23492
Risk Score
Threat Entry
Updated 2025-02-14
CVE-2025-23428 - QMean – WordPress Did You Mean Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound QMean – WordPress Did You Mean allows Reflected XSS. This issue affects QMean – WordPress Did You Mean: from n/a through 2.0.
PLUGIN
QMean – WordPress Did You Mean
CVE-2025-23428
Risk Score
Threat Entry
Updated 2025-02-25
CVE-2025-0821 - Bit Assist Plugin
Bit Assist plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Bit Assist
CVE-2025-0821
Risk Score
Threat Entry
Updated 2025-02-25
CVE-2024-13791 - Bit Assist Plugin
Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
PLUGIN
Bit Assist
CVE-2024-13791
Risk Score
Threat Entry
Updated 2025-02-25
CVE-2024-13735 - Hurrytimer Plugin
The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.11.2 due to insufficient input sanitization and output escaping of a campaign name. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Hurrytimer
CVE-2024-13735
Risk Score
Threat Entry
Updated 2025-02-25
CVE-2024-9601 - Qubely Plugin
The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Qubely
CVE-2024-9601
Risk Score
Threat Entry
Updated 2025-02-25
CVE-2024-13692 - Return Refund And Exchange For Woocommerce Plugin
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.4.5 via several functions due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite linked refund image attachments, overwrite refund request message, overwrite order messages, and read order messages of other users.
PLUGIN
Return Refund And Exchange For Woocommerce
CVE-2024-13692
Risk Score
Threat Entry
Updated 2025-05-14
CVE-2024-7052 - Forminator Forms Plugin
The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Forminator Forms
CVE-2024-7052
Risk Score
Threat Entry
Updated 2025-02-25
CVE-2024-13641 - Return Refund And Exchange For Woocommerce Plugin
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the 'attachment' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/attachment directory which can contain file attachments for order refunds.
PLUGIN
Return Refund And Exchange For Woocommerce
CVE-2024-13641
Risk Score
Threat Entry
Updated 2025-05-14
CVE-2024-13493 - Sensly Online Presence Plugin
The Sensly Online Presence WordPress plugin through 0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Sensly Online Presence
CVE-2024-13493
Risk Score
Threat Entry
Updated 2025-02-13
CVE-2024-13182 - Wp Directorybox Manager Plugin
The WP Directorybox Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_parse_request' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator.
PLUGIN
Wp Directorybox Manager
CVE-2024-13182
Risk Score
Threat Entry
Updated 2025-02-18
CVE-2024-13606 - Js Help Desk Plugin
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'jssupportticketdata' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/jssupportticketdata directory which can contain file attachments included in support tickets.
PLUGIN
Js Help Desk
CVE-2024-13606
Risk Score
Threat Entry
Updated 2025-02-18
CVE-2024-13867 - Listivo Plugin
The Listivo - Classified Ads WordPress Theme theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 2.3.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Listivo
CVE-2024-13867
Risk Score
Threat Entry
Updated 2025-02-18
CVE-2024-13639 - Read More Accordion Plugin
The Read More & Accordion plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the expmDeleteData() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary 'read more' posts.
PLUGIN
Read More Accordion
CVE-2024-13639
Risk Score
Threat Entry
Updated 2025-02-24
CVE-2025-0661 - Dethemekit For Elementor
The DethemeKit For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the duplicate_post() function due to insufficient restrictions on which posts can be duplicated. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, draft, or scheduled posts that they should not have access to by duplicating the post.
THEME
Dethemekit For Elementor
CVE-2025-0661
Risk Score
Threat Entry
Updated 2025-02-24
CVE-2024-13346 - Avada Plugin
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.11.13. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
PLUGIN
Avada
CVE-2024-13346
Risk Score
Threat Entry
Updated 2025-04-14
CVE-2024-13345 - Avada Builder Plugin
The Avada Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.11.13. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
PLUGIN
Avada Builder
CVE-2024-13345
Risk Score