Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-10-07
CVE-2024-7688 - Azindex Plugin
The AZIndex WordPress plugin through 0.8.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin delete arbitrary indexes via a CSRF attack
PLUGIN
Azindex
CVE-2024-7688
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-7918 - Pocket Widget Plugin
The Pocket Widget WordPress plugin through 0.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Pocket Widget
CVE-2024-7918
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-6910 - Before 2 Plugin
The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
PLUGIN
Before 2
CVE-2024-6910
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-7689 - Snapshot Backup Plugin
The Snapshot Backup WordPress plugin through 2.1.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
PLUGIN
Snapshot Backup
CVE-2024-7689
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-7687 - Azindex Plugin
The AZIndex WordPress plugin through 0.8.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
PLUGIN
Azindex
CVE-2024-7687
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-5561 - Popup Maker Plugin
The Popup Maker WordPress plugin before 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Popup Maker
CVE-2024-5561
Risk Score
Threat Entry
Updated 2024-10-07
CVE-2024-6928 - Opti Marketing Plugin
The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
PLUGIN
Opti Marketing
CVE-2024-6928
Risk Score
Threat Entry
Updated 2024-09-11
CVE-2024-6924 - Before 1 Plugin
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
PLUGIN
Before 1
CVE-2024-6924
Risk Score
Threat Entry
Updated 2024-09-11
CVE-2024-6859 - Wp Multitasking Plugin
The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Wp Multitasking
CVE-2024-6859
Risk Score
Threat Entry
Updated 2024-09-11
CVE-2024-6925 - Before 1 Plugin
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
PLUGIN
Before 1
CVE-2024-6925
Risk Score
Threat Entry
Updated 2024-09-11
CVE-2024-6856 - Wp Multitasking Plugin
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PLUGIN
Wp Multitasking
CVE-2024-6856
Risk Score
Threat Entry
Updated 2024-09-11
CVE-2024-6855 - Wp Multitasking Plugin
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack
PLUGIN
Wp Multitasking
CVE-2024-6855
Risk Score
Threat Entry
Updated 2024-09-11
CVE-2024-6853 - Wp Multitasking Plugin
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack
PLUGIN
Wp Multitasking
CVE-2024-6853
Risk Score
Threat Entry
Updated 2024-09-11
CVE-2024-6852 - Wp Multitasking Plugin
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PLUGIN
Wp Multitasking
CVE-2024-6852
Risk Score
Threat Entry
Updated 2024-09-26
CVE-2024-7112 - Pinpoint Booking System Plugin
The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘schedule’ parameter in all versions up to, and including, 2.9.9.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Pinpoint Booking System
CVE-2024-7112
Risk Score
Threat Entry
Updated 2025-07-10
CVE-2024-7620 - Customizer Export Import Plugin
The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: This vulnerability is only exploitable when used in conjunction with a race condition as the uploaded file is deleted shortly after it is created.
PLUGIN
Customizer Export Import
CVE-2024-7620
Risk Score
Threat Entry
Updated 2024-10-23
CVE-2024-6010 - Cost Calculator Builder Plugin
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_cc_order' function, called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator. Note: this vulnerability was partially patched with the release of Cost Calculator Builder version 3.2.17.
PLUGIN
Cost Calculator Builder
CVE-2024-6010
Risk Score
Threat Entry
Updated 2024-09-26
CVE-2024-1596 - Ninja Forms File Uploads Plugin
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Ninja Forms File Uploads
CVE-2024-1596
Risk Score
Threat Entry
Updated 2024-09-26
CVE-2024-8538 - Big File Uploads Plugin
The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1.2. This is due the plugin not sanitizing a file path in an error message. This makes it possible for authenticated attackers, with author-level access and above, to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an…
PLUGIN
Big File Uploads
CVE-2024-8538
Risk Score
Threat Entry
Updated 2024-09-26
CVE-2024-6849 - Preloader Plus Plugin
The Preloader Plus – WordPress Loading Screen Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
PLUGIN
Preloader Plus
CVE-2024-6849
Risk Score