sales@hackhalt.com
Free Download Free Download Free Download
Explore Pricing Explore Pricing Explore Pricing

Blog

"Prevention is cheaper than a breach"

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total18,903
Critical1,345
High4,572
Medium12,707
Reset
Showing 9321-9340 of 18903 records
Threat Entry Updated 2025-03-27

CVE-2025-30609 - WooCommerce Plugin

Insertion of Sensitive Information Into Sent Data vulnerability in AppExperts AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android Apps allows Retrieve Embedded Sensitive Data. This issue affects AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android Apps: from n/a through 1.4.3.

PLUGIN WooCommerce

CVE-2025-30609

MEDIUM CVSS 5.3 2025-03-24
Open Full Technical Breakdown
Threat Entry Updated 2025-04-08

CVE-2025-1203 - And Carousel By Metaslider Plugin

The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN And Carousel By Metaslider

CVE-2025-1203

LOW CVSS 3.5 2025-03-24
Open Full Technical Breakdown
Threat Entry Updated 2025-04-08

CVE-2025-1062 - And Carousel By Metaslider Plugin

The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN And Carousel By Metaslider

CVE-2025-1062

LOW CVSS 3.5 2025-03-24
Open Full Technical Breakdown
Threat Entry Updated 2025-05-13

CVE-2024-13124 - Photo Gallery By 10web Plugin

The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN Photo Gallery By 10web

CVE-2024-13124

LOW CVSS 3.5 2025-03-24
Open Full Technical Breakdown
Threat Entry Updated 2025-05-13

CVE-2024-10558 - Form Maker By 10web Plugin

The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN Form Maker By 10web

CVE-2024-10558

LOW CVSS 3.5 2025-03-24
Open Full Technical Breakdown
Threat Entry Updated 2025-04-02

CVE-2025-1446 - Before 3 Plugin

The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

PLUGIN Before 3

CVE-2025-1446

CRITICAL CVSS 9.8 2025-03-23
Open Full Technical Breakdown
Threat Entry Updated 2025-04-02

CVE-2025-0718 - Nested Pages Plugin

The Nested Pages WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN Nested Pages

CVE-2025-0718

MEDIUM CVSS 4.8 2025-03-23
Open Full Technical Breakdown
Threat Entry Updated 2025-03-22

CVE-2025-2186 - FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce Plugin

The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to SQL Injection via the ‘automationId’ parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

PLUGIN FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce

CVE-2025-2186

HIGH CVSS 7.5 2025-03-22
Open Full Technical Breakdown
Threat Entry Updated 2025-03-22

CVE-2025-2577 - Bitspecter Suite Plugin

The Bitspecter Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

PLUGIN Bitspecter Suite

CVE-2025-2577

MEDIUM CVSS 6.4 2025-03-22
Open Full Technical Breakdown
Threat Entry Updated 2025-07-09

CVE-2025-1971 - Import Export Wordpress Users Plugin

The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional…

PLUGIN Import Export Wordpress Users

CVE-2025-1971

HIGH CVSS 7.2 2025-03-22
Open Full Technical Breakdown
Threat Entry Updated 2025-08-11

CVE-2025-2331 - Givewp Plugin

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.22.1 via a misconfigured capability check in the 'permissionsCheck' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including reports detailing donors and donation amounts.

PLUGIN Givewp

CVE-2025-2331

MEDIUM CVSS 5.3 2025-03-22
Open Full Technical Breakdown
Threat Entry Updated 2025-07-09

CVE-2025-1973 - Import Export Wordpress Users Plugin

The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information.

PLUGIN Import Export Wordpress Users

CVE-2025-1973

MEDIUM CVSS 4.9 2025-03-22
Open Full Technical Breakdown
Threat Entry Updated 2025-07-09

CVE-2025-1972 - Import Export Wordpress Users Plugin

The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.

PLUGIN Import Export Wordpress Users

CVE-2025-1972

LOW CVSS 2.7 2025-03-22
Open Full Technical Breakdown
Threat Entry Updated 2025-07-09

CVE-2025-1970 - Import Export Wordpress Users Plugin

The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

PLUGIN Import Export Wordpress Users

CVE-2025-1970

HIGH CVSS 7.6 2025-03-22
Open Full Technical Breakdown
Threat Entry Updated 2025-03-22

CVE-2024-13666 - Conversational Form Builder Plugin

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.12 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers spoof their IP address and submit forms that may have IP-based restrictions.

PLUGIN Conversational Form Builder

CVE-2024-13666

MEDIUM CVSS 5.3 2025-03-22
Open Full Technical Breakdown
Threat Entry Updated 2025-03-22

CVE-2025-2484 - Multi Video Box Plugin

The Multi Video Box plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'video_id' and 'group_id' parameters in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

PLUGIN Multi Video Box

CVE-2025-2484

MEDIUM CVSS 6.1 2025-03-22
Open Full Technical Breakdown
Threat Entry Updated 2025-03-22

CVE-2025-2482 - Gotcha | Gesture-based Captcha Plugin

The Gotcha | Gesture-based Captcha plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'menu' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

PLUGIN Gotcha | Gesture-based Captcha

CVE-2025-2482

MEDIUM CVSS 6.1 2025-03-22
Open Full Technical Breakdown
Scroll to top