Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2024-37259 - Wp Extended Plugin
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended allows Reflected XSS.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 2.4.7.
PLUGIN
Wp Extended
CVE-2024-37259
Risk Score
Threat Entry
Updated 2025-03-19
CVE-2024-6244 - Pz Frontend Manager Plugin
The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
PLUGIN
Pz Frontend Manager
CVE-2024-6244
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-5973 - Masterstudy Lms Plugin
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.3.24 does not prevent students from creating instructor accounts, which could be used to get access to functionalities they shouldn't have.
PLUGIN
Masterstudy Lms
CVE-2024-5973
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-6271 - Community Events Plugin
The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete arbitrary events via a CSRF attack
PLUGIN
Community Events
CVE-2024-6271
Risk Score
Threat Entry
Updated 2026-01-30
CVE-2024-6243 - Html Forms Plugin
The HTML Forms WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disabled.
PLUGIN
Html Forms
CVE-2024-6243
Risk Score
Threat Entry
Updated 2025-03-18
CVE-2024-5529 - Wp Quicklatex Plugin
The WP QuickLaTeX WordPress plugin before 3.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Wp Quicklatex
CVE-2024-5529
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-5004 - Cm Popup Plugin For Wordpress
The CM Popup Plugin for WordPress WordPress plugin before 1.6.6 does not sanitise and escape some of the campaign settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
PLUGIN
Cm Popup Plugin For Wordpress
CVE-2024-5004
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-37519 - Premium Blocks For Gutenburg Plugin
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Leap13 Premium Blocks – Gutenberg Blocks for WordPress allows Stored XSS.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.1.27.
PLUGIN
Premium Blocks For Gutenburg
CVE-2024-37519
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-37556 - Wordpress Notification Bar Plugin
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SeedProd WordPress Notification Bar allows Stored XSS.This issue affects WordPress Notification Bar: from n/a through 1.3.10.
PLUGIN
Wordpress Notification Bar
CVE-2024-37556
Risk Score
Threat Entry
Updated 2025-03-20
CVE-2024-6848 - Post And Page Builder Plugin
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 1.26.6 due to insufficient input sanitization and output escaping affecting the boldgrid_canvas_image AJAX endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
PLUGIN
Post And Page Builder
CVE-2024-6848
Risk Score
Threat Entry
Updated 2025-04-05
CVE-2024-6497 - Seo Plugin By Squirrly Seo
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 12.3.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Seo Plugin By Squirrly Seo
CVE-2024-6497
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-37959 - Power Bi Embedded Plugin
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Atlas Public Policy Power BI Embedded for WordPress allows Stored XSS.This issue affects Power BI Embedded for WordPress: from n/a through 1.1.7.
PLUGIN
Power Bi Embedded
CVE-2024-37959
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-37946 - ReCaptcha Integration for WordPress Plugin
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in weDevs ReCaptcha Integration for WordPress allows Stored XSS.This issue affects ReCaptcha Integration for WordPress: from n/a through 1.2.5.
PLUGIN
ReCaptcha Integration for WordPress
CVE-2024-37946
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-37918 - ConeBlog – WordPress Blog Widgets Plugin
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPCone.Com ConeBlog – WordPress Blog Widgets allows Stored XSS.This issue affects ConeBlog – WordPress Blog Widgets: from n/a through 1.4.8.
PLUGIN
ConeBlog – WordPress Blog Widgets
CVE-2024-37918
Risk Score
Threat Entry
Updated 2025-02-11
CVE-2024-6636 - Woocommerce Social Login Plugin
The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'woo_slg_login_email' function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to change the default role to Administrator while registering for an account.
PLUGIN
Woocommerce Social Login
CVE-2024-6636
Risk Score
Threat Entry
Updated 2025-02-11
CVE-2024-6637 - Woocommerce Social Login Plugin
The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the one-time password for any user, except an Administrator, if they know the email of user.
PLUGIN
Woocommerce Social Login
CVE-2024-6637
Risk Score
Threat Entry
Updated 2025-02-11
CVE-2024-6635 - Woocommerce Social Login Plugin
The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is due to insufficient controls in the 'woo_slg_login_email' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, excluding an administrator, if they know the email of user.
PLUGIN
Woocommerce Social Login
CVE-2024-6635
Risk Score
Threat Entry
Updated 2025-02-04
CVE-2024-6491 - Getwid Plugin
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mailchimp_api_key_manage function in all versions up to, and including, 2.0.10. This makes it possible for authenticated attackers, with Contributor-level access and above, to set the MailChimp API key.
PLUGIN
Getwid
CVE-2024-6491
Risk Score
Threat Entry
Updated 2025-02-04
CVE-2024-6489 - Getwid Plugin
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_google_api_key function in all versions up to, and including, 2.0.10. This makes it possible for authenticated attackers, with Contributor-level access and above, to set the MailChimp API key.
PLUGIN
Getwid
CVE-2024-6489
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-6694 - Wp Mail Smtp Plugin
The WP Mail SMTP plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 4.0.1. This is due to plugin providing the SMTP password in the SMTP Password field when viewing the settings. This makes it possible for authenticated attackers, with administrative-level access and above, to view the SMTP password for the supplied server. Although this would not be useful for attackers in most cases, if an administrator account becomes compromised this could be useful information to an attacker in a limited environment.
PLUGIN
Wp Mail Smtp
CVE-2024-6694
Risk Score