Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-05-14
CVE-2024-3048 - Bannerlid Plugin
The Bannerlid WordPress plugin through 1.1.0 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators
PLUGIN
Bannerlid
CVE-2024-3048
Risk Score
Threat Entry
Updated 2025-05-07
CVE-2024-3058 - Enl Newsletter Plugin
The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
PLUGIN
Enl Newsletter
CVE-2024-3058
Risk Score
Threat Entry
Updated 2025-04-14
CVE-2024-2837 - Before 3 Plugin
The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
PLUGIN
Before 3
CVE-2024-2837
Risk Score
Threat Entry
Updated 2025-04-14
CVE-2024-2439 - Salon Booking System Plugin
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Salon Booking System
CVE-2024-2439
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-2159 - Social Sharing Plugin
The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Social Sharing
CVE-2024-2159
Risk Score
Threat Entry
Updated 2025-05-07
CVE-2024-3060 - Enl Newsletter Plugin
The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks
PLUGIN
Enl Newsletter
CVE-2024-3060
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-2908 - Call Now Button Plugin
The Call Now Button WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Call Now Button
CVE-2024-2908
Risk Score
Threat Entry
Updated 2025-04-14
CVE-2024-2429 - Salon Booking System Plugin
The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PLUGIN
Salon Booking System
CVE-2024-2429
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-0905 - Fancy Product Designer Plugin
The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against unauthenticated and admin-level users
PLUGIN
Fancy Product Designer
CVE-2024-0905
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-3265 - Advance Search Plugin
The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administrator role to conduct SQL Injection attacks in the context of a multisite WordPress configurations.
PLUGIN
Advance Search
CVE-2024-3265
Risk Score
Threat Entry
Updated 2025-02-05
CVE-2024-3730 - Simple Membership Plugin
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Simple Membership
CVE-2024-3730
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-4035 - photo_gallery Theme
The Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 2.7.7.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
photo_gallery
CVE-2024-4035
Risk Score
Threat Entry
Updated 2025-01-15
CVE-2024-3994 - Tutor Lms Plugin
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutor_instructor_list' shortcode in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Tutor Lms
CVE-2024-3994
Risk Score
Threat Entry
Updated 2025-01-10
CVE-2024-3733 - Essential Addons For Elementor Plugin
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.9.15 via the ajax_load_more() , eael_woo_pagination_product_ajax(), and ajax_eael_product_gallery() functions. This makes it possible for unauthenticated attackers to extract posts that may be in private or draft status.
PLUGIN
Essential Addons For Elementor
CVE-2024-3733
Risk Score
Threat Entry
Updated 2025-02-07
CVE-2024-3988 - Sina Extension For Elementor Plugin
The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Fancy Text Widget in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Sina Extension For Elementor
CVE-2024-3988
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3929 - Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) Plugin
The Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Widget Post Overlay block in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode)
CVE-2024-3929
Risk Score
Threat Entry
Updated 2025-04-23
CVE-2024-3893 - Classified Listing Plugin
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the rtcl_fb_gallery_image_delete AJAX action in all versions up to, and including, 3.0.10.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary attachements.
PLUGIN
Classified Listing
CVE-2024-3893
Risk Score
Threat Entry
Updated 2025-05-14
CVE-2024-2907 - Before 7 Plugin
The AGCA WordPress plugin before 7.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 7
CVE-2024-2907
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-32835 - Import Export WordPress Users Plugin
Deserialization of Untrusted Data vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.3.
PLUGIN
Import Export WordPress Users
CVE-2024-32835
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-32788 - FG Joomla to WordPress Plugin
Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Joomla to WordPress.This issue affects FG Joomla to WordPress: from n/a through 4.20.2.
PLUGIN
FG Joomla to WordPress
CVE-2024-32788
Risk Score