Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-10-07
CVE-2024-7786 - Before 4 Plugin
The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates.
PLUGIN
Before 4
CVE-2024-7786
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-6889 - Secure Copy Content Protection And Content Locking Plugin
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Secure Copy Content Protection And Content Locking
CVE-2024-6889
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-6888 - Secure Copy Content Protection And Content Locking Plugin
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Secure Copy Content Protection And Content Locking
CVE-2024-6888
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-6722 - Chatbot Support Ai Plugin
The Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Chatbot Support Ai
CVE-2024-6722
Risk Score
Threat Entry
Updated 2024-10-04
CVE-2024-7950 - Wp Job Portal Plugin
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Local File Inclusion, Arbitrary Settings Update, and User Creation in all versions up to, and including, 2.1.6 via several functions called by the 'checkFormRequest' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where…
PLUGIN
Wp Job Portal
CVE-2024-7950
Risk Score
Threat Entry
Updated 2024-10-04
CVE-2024-7692 - Flaming Forms Plugin
The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Flaming Forms
CVE-2024-7692
Risk Score
Threat Entry
Updated 2024-10-04
CVE-2024-7691 - Flaming Forms Plugin
The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators.
PLUGIN
Flaming Forms
CVE-2024-7691
Risk Score
Threat Entry
Updated 2024-10-04
CVE-2024-7354 - Before 3 Plugin
The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 3
CVE-2024-7354
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-7690 - Dn Popup Plugin
The DN Popup WordPress plugin through 1.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PLUGIN
Dn Popup
CVE-2024-7690
Risk Score
Threat Entry
Updated 2025-03-13
CVE-2024-45270 - Carousel Slider Plugin
WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feature. While logged in to the WordPress site with Carousel Slider plugin enabled, accessing a crafted page may cause a user to alter the contents of the WordPress site.
PLUGIN
Carousel Slider
CVE-2024-45270
Risk Score
Threat Entry
Updated 2025-03-13
CVE-2024-45269 - Carousel Slider Plugin
WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection feature. While logged in to the WordPress site with Carousel Slider plugin enabled, accessing a crafted page may cause a user to alter the contents of the WordPress site.
PLUGIN
Carousel Slider
CVE-2024-45269
Risk Score
Threat Entry
Updated 2024-10-04
CVE-2024-5053 - Contact Form Plugin
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key update due to an insufficient capability check on the verifyRequest function in all versions up to, and including, 5.1.18. This makes it possible for Form Managers with a Subscriber-level access and above to modify the Mailchimp API key used for integration. At the same time, missing Mailchimp API key validation allows the redirect of the integration requests to the attacker-controlled server.
PLUGIN
Contact Form
CVE-2024-5053
Risk Score
Threat Entry
Updated 2024-09-20
CVE-2024-7717 - Wp Events Manager Plugin
The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 2.1.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Wp Events Manager
CVE-2024-7717
Risk Score
Threat Entry
Updated 2024-09-19
CVE-2024-8108 - Share This Image Plugin
The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alignment' parameter in all versions up to, and including, 2.01 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Share This Image
CVE-2024-8108
Risk Score
Threat Entry
Updated 2024-09-13
CVE-2024-8276 - Wpzoom Portfolio Plugin
The WPZOOM Portfolio Lite – Filterable Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:wpzoom-blocks' Gutenberg block in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wpzoom Portfolio
CVE-2024-8276
Risk Score
Threat Entry
Updated 2024-09-03
CVE-2024-5212 - Tagdiv Composer Plugin
The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping within the on_ajax_register_forum_user function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Tagdiv Composer
CVE-2024-5212
Risk Score
Threat Entry
Updated 2024-09-03
CVE-2024-3886 - Tagdiv Composer Plugin
The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping within the on_ajax_check_envato_code function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Tagdiv Composer
CVE-2024-3886
Risk Score
Threat Entry
Updated 2025-07-10
CVE-2024-7435 - Attire Plugin
The Attire theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
PLUGIN
Attire
CVE-2024-7435
Risk Score
Threat Entry
Updated 2024-09-03
CVE-2024-8274 - Wp Booking Calendar Plugin
The WP Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters from 'timeline_obj' in all versions up to, and including, 10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Wp Booking Calendar
CVE-2024-8274
Risk Score
Threat Entry
Updated 2024-09-03
CVE-2024-8252 - Clean Login Plugin
The Clean Login plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.14.5 via the 'template' attribute of the clean-login-register shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
PLUGIN
Clean Login
CVE-2024-8252
Risk Score