Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-04-07
CVE-2025-1233 - Lafka Plugin
The Lafka Plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_options_upload' AJAX function in all versions up to, and including, 7.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the theme option that overrides the site.
PLUGIN
Lafka
CVE-2025-1233
Risk Score
Threat Entry
Updated 2025-06-04
CVE-2024-13776 - Zoomsounds Plugin
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'dzsap_delete_notice' AJAX action in all versions up to, and including, 6.91. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'seen' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users…
PLUGIN
Zoomsounds
CVE-2024-13776
Risk Score
Threat Entry
Updated 2025-04-07
CVE-2025-2933 - Email Notifications For Updates Plugin
The Email Notifications for Updates plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the awun_import_settings() function in all versions up to, and including, 1.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
PLUGIN
Email Notifications For Updates
CVE-2025-2933
Risk Score
Threat Entry
Updated 2025-04-07
CVE-2025-0810 - Expand Maker Plugin
The Read More & Accordion plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.5. This is due to missing or incorrect nonce validation on the addNewButtons() function. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Expand Maker
CVE-2025-0810
Risk Score
Threat Entry
Updated 2025-04-07
CVE-2025-2544 - Ai Content Pipelines Plugin
The AI Content Pipelines plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
PLUGIN
Ai Content Pipelines
CVE-2025-2544
Risk Score
Threat Entry
Updated 2025-04-07
CVE-2024-13604 - Kb Support Plugin
The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.4 via the 'kbs' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/kbs directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 1.7.3.2.
PLUGIN
Kb Support
CVE-2024-13604
Risk Score
Threat Entry
Updated 2025-04-07
CVE-2025-2889 - Link Library Plugin
The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Link Additional Parameters in all versions up to, and including, 7.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Link Library
CVE-2025-2889
Risk Score
Threat Entry
Updated 2025-04-07
CVE-2025-32267 - Post to Social Media – WordPress to Hootsuite Plugin
Cross-Site Request Forgery (CSRF) vulnerability in wpzinc Post to Social Media – WordPress to Hootsuite allows Cross Site Request Forgery. This issue affects Post to Social Media – WordPress to Hootsuite: from n/a through 1.5.8.
PLUGIN
Post to Social Media – WordPress to Hootsuite
CVE-2025-32267
Risk Score
Threat Entry
Updated 2025-04-07
CVE-2025-32257 - 1 Click WordPress Migration Plugin
Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click WordPress Migration allows Retrieve Embedded Sensitive Data. This issue affects 1 Click WordPress Migration: from n/a through 2.2.
PLUGIN
1 Click WordPress Migration
CVE-2025-32257
Risk Score
Threat Entry
Updated 2026-02-20
CVE-2025-32238 - Online Booking Scheduling Calendar Plugin
Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita allows Retrieve Embedded Sensitive Data. This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.5.2.
PLUGIN
Online Booking Scheduling Calendar
CVE-2025-32238
Risk Score
Threat Entry
Updated 2025-04-07
CVE-2025-32218 - TableOn – WordPress Posts Table Filterable Plugin
Missing Authorization vulnerability in RealMag777 TableOn – WordPress Posts Table Filterable allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects TableOn – WordPress Posts Table Filterable: from n/a through 1.0.4.
PLUGIN
TableOn – WordPress Posts Table Filterable
CVE-2025-32218
Risk Score
Threat Entry
Updated 2025-04-07
CVE-2025-32172 - YaMaps for WordPress Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yuri Baranov YaMaps for WordPress allows Stored XSS. This issue affects YaMaps for WordPress: from n/a through 0.6.31.
PLUGIN
YaMaps for WordPress
CVE-2025-32172
Risk Score
Threat Entry
Updated 2025-04-07
CVE-2025-32166 - Emma for WordPress Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John Housholder Emma for WordPress allows Stored XSS. This issue affects Emma for WordPress: from n/a through 1.3.3.
PLUGIN
Emma for WordPress
CVE-2025-32166
Risk Score
Threat Entry
Updated 2025-08-08
CVE-2025-2798 - Woffice Plugin
The Woffice CRM theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.21. This is due to a misconfiguration of excluded roles during registration. This makes it possible for unauthenticated attackers to register with an Administrator role if a custom login form is being used. This can be combined with CVE-2025-2797 to bypass the user approval process if an Administrator can be tricked into taking an action such as clicking a link.
PLUGIN
Woffice
CVE-2025-2798
Risk Score
Threat Entry
Updated 2025-04-07
CVE-2025-22282 - Allows Reflected Xss Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EPC ez Form Calculator - WordPress plugin allows Reflected XSS.This issue affects ez Form Calculator - WordPress plugin: from n/a through 2.14.1.2.
PLUGIN
Allows Reflected Xss
CVE-2025-22282
Risk Score
Threat Entry
Updated 2025-04-07
CVE-2025-3105 - Vehica Core Plugin
The Vehica Core plugin for WordPress, used by the Vehica - Car Dealer & Listing WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 1.0.97. This is due to the plugin not properly validating user meta fields prior to updating them in the database. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change escalate their privileges to Administrator.
PLUGIN
Vehica Core
CVE-2025-3105
Risk Score
Threat Entry
Updated 2025-08-08
CVE-2025-2797 - Woffice Plugin
The Woffice Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.4.21. This is due to missing or incorrect nonce validation on the 'woffice_handle_user_approval_actions' function. This makes it possible for unauthenticated attackers to approve registration for any user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Woffice
CVE-2025-2797
Risk Score
Threat Entry
Updated 2025-08-08
CVE-2025-2780 - Woffice Plugin
The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveFeaturedImage' function in all versions up to, and including, 5.4.21. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Woffice
CVE-2025-2780
Risk Score
Threat Entry
Updated 2025-04-07
CVE-2025-2836 - Custom Registration Form Builder With Submission Manager Plugin
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘payment_method’ parameter in all versions up to, and including, 6.0.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Custom Registration Form Builder With Submission Manager
CVE-2025-2836
Risk Score
Threat Entry
Updated 2025-04-07
CVE-2025-2270 - Countdown Builder Plugin
The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.9.1 via the createCdObj function. This makes it possible for unauthenticated attackers to include and execute files with the specific filenames on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in some cases.
PLUGIN
Countdown Builder
CVE-2025-2270
Risk Score