Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-04-08
CVE-2024-1307 - Smart Forms Plugin
The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as low as a subscriber to call them and perform unauthorized actions
PLUGIN
Smart Forms
CVE-2024-1307
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2023-7201 - Everest Backup Plugin
The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
PLUGIN
Everest Backup
CVE-2023-7201
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-1746 - Testimonial Slider Plugin
The Testimonial Slider WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Testimonial Slider
CVE-2024-1746
Risk Score
Threat Entry
Updated 2025-04-08
CVE-2024-1306 - Smart Forms Plugin
The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk.
PLUGIN
Smart Forms
CVE-2024-1306
Risk Score
Threat Entry
Updated 2025-05-27
CVE-2024-1310 - Before 8 Plugin
The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products)
PLUGIN
Before 8
CVE-2024-1310
Risk Score
Threat Entry
Updated 2025-05-08
CVE-2024-1660 - Top Bar Plugin
The Top Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Top Bar
CVE-2024-1660
Risk Score
Threat Entry
Updated 2025-04-07
CVE-2024-0902 - Before 6 Plugin
The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Before 6
CVE-2024-0902
Risk Score
Threat Entry
Updated 2025-04-08
CVE-2024-1712 - Carousel Slider Plugin
The Carousel Slider WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Carousel Slider
CVE-2024-1712
Risk Score
Threat Entry
Updated 2025-05-15
CVE-2024-1204 - Meta Box Plugin
The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts.
PLUGIN
Meta Box
CVE-2024-1204
Risk Score
Threat Entry
Updated 2025-05-09
CVE-2023-6067 - Wp User Profile Avatar Plugin
The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Wp User Profile Avatar
CVE-2023-6067
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3662 - WPZOOM Social Feed Widget & Block Plugin
The WPZOOM Social Feed Widget & Block plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpzoom_instagram_clear_data() function in all versions up to, and including, 2.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all Instagram images installed on the site.
PLUGIN
WPZOOM Social Feed Widget & Block
CVE-2024-3662
Risk Score
Threat Entry
Updated 2025-06-17
CVE-2023-6494 - Wpc Smart Quick View For Woocommerce Plugin
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Wpc Smart Quick View For Woocommerce
CVE-2023-6494
Risk Score
Threat Entry
Updated 2025-05-12
CVE-2024-2583 - Shortcodes Ultimate Plugin
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible for users with the contributor role to conduct Stored XSS attacks.
PLUGIN
Shortcodes Ultimate
CVE-2024-2583
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3027 - Smart Slider 3 Plugin
The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all versions up to, and including, 3.5.1.22. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files, including SVG files, which can be used to conduct stored cross-site scripting attacks.
PLUGIN
Smart Slider 3
CVE-2024-3027
Risk Score
Threat Entry
Updated 2025-02-27
CVE-2024-1957 - Givewp Plugin
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Givewp
CVE-2024-1957
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-31235 - WordPress Comments Import & Export Plugin
Cross-Site Request Forgery (CSRF) vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.5.
PLUGIN
WordPress Comments Import & Export
CVE-2024-31235
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-3211 - Shopping Cart & eCommerce Store Plugin
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to SQL Injection via the 'productid' attribute of the ec_addtocart shortcode in all versions up to, and including, 5.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Shopping Cart & eCommerce Store
CVE-2024-3211
Risk Score
Threat Entry
Updated 2025-02-27
CVE-2024-3054 - Migration Backup Staging Plugin
WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deserialization of untrusted input at the wpvividstg_get_custom_exclude_path_free action. This is due to the plugin not providing sufficient path validation on the tree_node[node][id] parameter. This makes it possible for authenticated attackers, with admin-level access and above, to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects. No POP chain is present in the vulnerable plugin. If a POP chain is present via an…
PLUGIN
Migration Backup Staging
CVE-2024-3054
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2801 - Shopkeeper Extender Plugin
The Shopkeeper Extender plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'image_slide' shortcode in all versions up to, and including, 3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Shopkeeper Extender
CVE-2024-2801
Risk Score
Threat Entry
Updated 2025-04-08
CVE-2024-2137 - All In One Addons For Elementor Plugin
The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple pricing widgets (e.g. Pricing Single, Pricing Icon, Pricing Tab) in all versions up to, and including, 2.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
All In One Addons For Elementor
CVE-2024-2137
Risk Score