Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-06-16
CVE-2025-5487 - Custom Integrations In Wordpress Plugin
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the field_conditions parameter in all versions up to, and including, 5.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Administrators can configure the…
PLUGIN
Custom Integrations In Wordpress
CVE-2025-5487
Risk Score
Threat Entry
Updated 2025-06-16
CVE-2025-3234 - Filester Plugin
The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.8.8. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Administrators have the ability to extend file manager usage privileges to lower-level users including subscribers, which would make this vulnerability more severe on such sites.
PLUGIN
Filester
CVE-2025-3234
Risk Score
Threat Entry
Updated 2025-06-16
CVE-2025-6059 - Seraphinite Accelerator Plugin
The Seraphinite Accelerator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.27.21. This is due to missing or incorrect nonce validation on the 'OnAdminApi_CacheOpBegin' function. This makes it possible for unauthenticated attackers to perform several administrative actions, including deleting the cache, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Seraphinite Accelerator
CVE-2025-6059
Risk Score
Threat Entry
Updated 2025-06-16
CVE-2025-6012 - Auto Attachments Plugin
The Auto Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Auto Attachments
CVE-2025-6012
Risk Score
Threat Entry
Updated 2025-06-16
CVE-2025-5923 - Game Review Block Plugin
The Game Review Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Game Review Block
CVE-2025-5923
Risk Score
Threat Entry
Updated 2025-06-16
CVE-2025-5815 - Traffic Monitor Plugin
The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcm_maybe_set_bot_flags() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to disabled bot logging.
PLUGIN
Traffic Monitor
CVE-2025-5815
Risk Score
Threat Entry
Updated 2025-07-10
CVE-2025-5282 - Wp Travel Engine Plugin
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_package() function in all versions up to, and including, 6.5.1. This makes it possible for unauthenticated attackers to delete arbitrary posts.
PLUGIN
Wp Travel Engine
CVE-2025-5282
Risk Score
Threat Entry
Updated 2025-07-10
CVE-2025-5950 - Indieblocks Plugin
The IndieBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘kind’ parameter in all versions up to, and including, 0.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Indieblocks
CVE-2025-5950
Risk Score
Threat Entry
Updated 2025-07-10
CVE-2025-5938 - Digital Marketing And Agency Templates Addons For Elementor Plugin
The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the import_templates() function. This makes it possible for unauthenticated attackers to trigger an import via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Digital Marketing And Agency Templates Addons For Elementor
CVE-2025-5938
Risk Score
Threat Entry
Updated 2025-06-16
CVE-2025-5939 - Telegram For Wp Plugin
The Telegram for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Telegram For Wp
CVE-2025-5939
Risk Score
Threat Entry
Updated 2025-06-16
CVE-2025-5288 - Import Export With Custom Rest Api Plugin
The REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the process_handler() function in versions 1.0.0 to 2.0.3. This makes it possible for unauthenticated attackers to POST an arbitrary import_api URL, import specially crafted JSON, and thereby create a new user with full Administrator privileges.
PLUGIN
Import Export With Custom Rest Api
CVE-2025-5288
Risk Score
Threat Entry
Updated 2025-06-16
CVE-2025-5841 - Acf Onyx Poll Plugin
The ACF Onyx Poll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Acf Onyx Poll
CVE-2025-5841
Risk Score
Threat Entry
Updated 2025-06-16
CVE-2025-5233 - Color Palette Plugin
The Color Palette plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hex’ parameter in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Color Palette
CVE-2025-5233
Risk Score
Threat Entry
Updated 2025-06-16
CVE-2025-5926 - Link Shield Plugin
The Link Shield plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.4. This is due to missing or incorrect nonce validation on the link_shield_menu_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Link Shield
CVE-2025-5926
Risk Score
Threat Entry
Updated 2025-06-16
CVE-2025-5930 - Wp2html Plugin
The WP2HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Wp2html
CVE-2025-5930
Risk Score
Threat Entry
Updated 2025-06-16
CVE-2025-5928 - Wp Sliding Logindashboard Panel Plugin
The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wp_sliding_panel_user_options() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Wp Sliding Logindashboard Panel
CVE-2025-5928
Risk Score
Threat Entry
Updated 2025-07-10
CVE-2025-5123 - Contact Us Page Contact People Plugin
The Contact Us Page – Contact People plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and including, 3.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Contact Us Page Contact People
CVE-2025-5123
Risk Score
Threat Entry
Updated 2025-07-03
CVE-2025-4586 - Irm Newsroom Plugin
The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmcalendarview' shortcode in all versions up to, and including, 1.2.17 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Irm Newsroom
CVE-2025-4586
Risk Score
Threat Entry
Updated 2025-07-03
CVE-2025-4585 - Irm Newsroom Plugin
The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmflat' shortcode in all versions up to, and including, 1.2.17 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Irm Newsroom
CVE-2025-4585
Risk Score
Threat Entry
Updated 2025-07-03
CVE-2025-4584 - Irm Newsroom Plugin
The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmeventlist' shortcode in all versions up to, and including, 1.2.17 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Irm Newsroom
CVE-2025-4584
Risk Score