Calgary, Alberta, Canada
sales@hackhalt.com
Free Download Free Download Free Download
Explore Pricing Explore Pricing Explore Pricing

Blog

"Prevention is cheaper than a breach"

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total15,036
Critical923
High3,047
Medium10,866
Reset
Showing 10021-10040 of 15036 records
Threat Entry Updated 2024-11-21

CVE-2024-3027 - Smart Slider 3 Plugin

The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all versions up to, and including, 3.5.1.22. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files, including SVG files, which can be used to conduct stored cross-site scripting attacks.

PLUGIN Smart Slider 3

CVE-2024-3027

MEDIUM CVSS 6.4 2024-04-13
Open Full Technical Breakdown
Threat Entry Updated 2025-02-27

CVE-2024-1957 - Givewp Plugin

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Givewp

CVE-2024-1957

MEDIUM CVSS 6.4 2024-04-13
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2024-3211 - shopping_cart_and_ecommerce_store Plugin

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to SQL Injection via the 'productid' attribute of the ec_addtocart shortcode in all versions up to, and including, 5.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

PLUGIN shopping_cart_and_ecommerce_store

CVE-2024-3211

HIGH CVSS 8.8 2024-04-12
Open Full Technical Breakdown
Threat Entry Updated 2025-02-27

CVE-2024-3054 - Migration Backup Staging Plugin

WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deserialization of untrusted input at the wpvividstg_get_custom_exclude_path_free action. This is due to the plugin not providing sufficient path validation on the tree_node[node][id] parameter. This makes it possible for authenticated attackers, with admin-level access and above, to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects. No POP chain is present in the vulnerable plugin. If a POP chain is present via an…

PLUGIN Migration Backup Staging

CVE-2024-3054

HIGH CVSS 7.2 2024-04-12
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2024-2801 - Shopkeeper Extender Plugin

The Shopkeeper Extender plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'image_slide' shortcode in all versions up to, and including, 3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Shopkeeper Extender

CVE-2024-2801

MEDIUM CVSS 6.4 2024-04-12
Open Full Technical Breakdown
Threat Entry Updated 2025-04-08

CVE-2024-2137 - All In One Addons For Elementor Plugin

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple pricing widgets (e.g. Pricing Single, Pricing Icon, Pricing Tab) in all versions up to, and including, 2.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN All In One Addons For Elementor

CVE-2024-2137

MEDIUM CVSS 6.4 2024-04-12
Open Full Technical Breakdown
Threat Entry Updated 2025-05-09

CVE-2024-0881 - Post Carousel Plugin

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts

PLUGIN Post Carousel

CVE-2024-0881

MEDIUM CVSS 5.4 2024-04-11
Open Full Technical Breakdown
Threat Entry Updated 2025-01-22

CVE-2024-3344 - Otter Blocks Plugin

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Otter Blocks

CVE-2024-3344

MEDIUM CVSS 6.4 2024-04-11
Open Full Technical Breakdown
Threat Entry Updated 2025-01-22

CVE-2024-3343 - Otter Blocks Plugin

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Otter Blocks

CVE-2024-3343

MEDIUM CVSS 6.4 2024-04-11
Open Full Technical Breakdown
Threat Entry Updated 2025-04-08

CVE-2024-3285 - Slider Gallery And Carousel Plugin

The Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'metaslider' shortcode in all versions up to, and including, 3.70.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Slider Gallery And Carousel

CVE-2024-3285

MEDIUM CVSS 6.4 2024-04-11
Open Full Technical Breakdown
Threat Entry Updated 2025-01-21

CVE-2024-2966 - Element Pack Plugin

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.6 via the element_pack_ajax_search function. This makes it possible for unauthenticated attackers to extract sensitive data including password protected post details.

PLUGIN Element Pack

CVE-2024-2966

MEDIUM CVSS 5.3 2024-04-11
Open Full Technical Breakdown
Threat Entry Updated 2025-05-09

CVE-2023-6257 - Inline Related Posts Plugin

The Inline Related Posts WordPress plugin before 3.6.0 is missing authorization in an AJAX action to ensure that users are allowed to see the content of the posts displayed, allowing any authenticated user, such as subscriber to retrieve the content of password protected posts

PLUGIN Inline Related Posts

CVE-2023-6257

MEDIUM CVSS 4.3 2024-04-11
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2023-6811 - language_translate_widget_for_word_press_conveythis Plugin

The Language Translate Widget for WordPress – ConveyThis plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key’ parameter in all versions up to, and including, 223 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN language_translate_widget_for_word_press_conveythis

CVE-2023-6811

HIGH CVSS 7.2 2024-04-11
Open Full Technical Breakdown
Threat Entry Updated 2025-03-12

CVE-2024-31430 - Bear Woocommerce Bulk Editor And Products Manager Professional Plugin

Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional, realmag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net.This issue affects WOLF – WordPress Posts Bulk Editor and Manager Professional: from n/a through 1.0.8.1; BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net: from n/a through 1.1.4.1.

PLUGIN Bear Woocommerce Bulk Editor And Products Manager Professional

CVE-2024-31430

MEDIUM CVSS 4.3 2024-04-10
Open Full Technical Breakdown
Threat Entry Updated 2025-04-08

CVE-2024-31247 - Fg Drupal Plugin

Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Drupal to WordPress.This issue affects FG Drupal to WordPress: from n/a through 3.70.3.

PLUGIN Fg Drupal

CVE-2024-31247

MEDIUM CVSS 5.3 2024-04-10
Open Full Technical Breakdown
Scroll to top