Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-05-28
CVE-2025-2162 - Mappress Maps For Plugin
The MapPress Maps for WordPress plugin before 2.94.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Mappress Maps For
CVE-2025-2162
Risk Score
Threat Entry
Updated 2025-04-21
CVE-2025-3520 - Avatar Plugin
The Avatar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 0.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
PLUGIN
Avatar
CVE-2025-3520
Risk Score
Threat Entry
Updated 2025-04-21
CVE-2024-13650 - Piotnet Addons For Elementor Plugin
The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'PAFE Before After Image Comparison Slider' widget in all versions up to, and including, 2.4.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Piotnet Addons For Elementor
CVE-2024-13650
Risk Score
Threat Entry
Updated 2025-04-21
CVE-2025-2613 - Customized Login Plugin
The Login Manager – Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom logo and background URLs in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Customized Login
CVE-2025-2613
Risk Score
Threat Entry
Updated 2025-04-17
CVE-2025-39431 - Allows Stored Xss Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Aaron Forgue Amazon Showcase WordPress Plugin allows Stored XSS. This issue affects Amazon Showcase WordPress Plugin: from n/a through 2.2.
PLUGIN
Allows Stored Xss
CVE-2025-39431
Risk Score
Threat Entry
Updated 2025-04-17
CVE-2025-39417 - Redirect wordpress to welcome or landing page Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Eslam Mahmoud Redirect wordpress to welcome or landing page allows Stored XSS. This issue affects Redirect wordpress to welcome or landing page: from n/a through 2.0.
PLUGIN
Redirect wordpress to welcome or landing page
CVE-2025-39417
Risk Score
Threat Entry
Updated 2025-04-17
CVE-2025-32630 - WP-BusinessDirectory Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory allows Reflected XSS. This issue affects WP-BusinessDirectory: from n/a through 3.1.2.
PLUGIN
WP-BusinessDirectory
CVE-2025-32630
Risk Score
Threat Entry
Updated 2025-04-17
CVE-2025-32592 - TableOn – WordPress Posts Table Filterable Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 TableOn – WordPress Posts Table Filterable allows Stored XSS. This issue affects TableOn – WordPress Posts Table Filterable: from n/a through 1.0.3.
PLUGIN
TableOn – WordPress Posts Table Filterable
CVE-2025-32592
Risk Score
Threat Entry
Updated 2025-04-17
CVE-2025-32520 - WordPress Core
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M. Ali Saleem WordPress Health and Server Condition – Integrated with Google Page Speed allows Reflected XSS. This issue affects WordPress Health and Server Condition – Integrated with Google Page Speed: from n/a through 4.1.1.
CORE
WordPress Core
CVE-2025-32520
Risk Score
Threat Entry
Updated 2025-04-17
CVE-2025-27291 - WordPress Photo Gallery – Image Gallery Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxgallery WordPress Photo Gallery – Image Gallery allows Reflected XSS. This issue affects WordPress Photo Gallery – Image Gallery: from n/a through 2.0.4.
PLUGIN
WordPress Photo Gallery – Image Gallery
CVE-2025-27291
Risk Score
Threat Entry
Updated 2025-04-17
CVE-2025-24651 - WordPress Backup & Migration Plugin
Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration allows Retrieve Embedded Sensitive Data. This issue affects WordPress Backup & Migration: from n/a through 1.5.3.
PLUGIN
WordPress Backup & Migration
CVE-2025-24651
Risk Score
Threat Entry
Updated 2025-04-17
CVE-2025-24548 - Autoglot – Automatic WordPress Translation Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Autoglot Autoglot – Automatic WordPress Translation allows Reflected XSS. This issue affects Autoglot – Automatic WordPress Translation: from n/a through 2.4.7.
PLUGIN
Autoglot – Automatic WordPress Translation
CVE-2025-24548
Risk Score
Threat Entry
Updated 2025-04-17
CVE-2025-23906 - WordPress Dashboard Tweeter Plugin
Missing Authorization vulnerability in wpseek WordPress Dashboard Tweeter allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WordPress Dashboard Tweeter: from n/a through 1.3.2.
PLUGIN
WordPress Dashboard Tweeter
CVE-2025-23906
Risk Score
Threat Entry
Updated 2025-05-28
CVE-2025-3487 - Forminator Forms Plugin
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘limit’ parameter in all versions up to, and including, 1.42.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Forminator Forms
CVE-2025-3487
Risk Score
Threat Entry
Updated 2025-05-28
CVE-2025-3479 - Forminator Forms Plugin
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_single' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order.
PLUGIN
Forminator Forms
CVE-2025-3479
Risk Score
Threat Entry
Updated 2025-04-17
CVE-2025-3453 - Password Protected Plugin
The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.7 via the 'password_protected_cookie' function. This makes it possible for unauthenticated attackers to extract sensitive data including all protected site content if the 'Use Transient' setting is enabled.
PLUGIN
Password Protected
CVE-2025-3453
Risk Score
Threat Entry
Updated 2025-04-17
CVE-2025-3615 - Fluent Forms Plugin
The Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form-submission.js script in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Fluent Forms
CVE-2025-3615
Risk Score
Threat Entry
Updated 2025-07-09
CVE-2025-3295 - Wp Editor Plugin
The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the affected site's server which may reveal sensitive information.
PLUGIN
Wp Editor
CVE-2025-3295
Risk Score
Threat Entry
Updated 2025-04-29
CVE-2024-13925 - Klarna Checkout For Woocommerce Plugin
The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per request. This can result in rapid consumption of disk space, potentially filling the entire disk.
PLUGIN
Klarna Checkout For Woocommerce
CVE-2024-13925
Risk Score
Threat Entry
Updated 2025-07-09
CVE-2025-3294 - Wp Editor Plugin
The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to overwrite arbitrary files on the affected site's server which may make remote code execution possible assuming the files can be written to by the web server.
PLUGIN
Wp Editor
CVE-2025-3294
Risk Score