Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2024-2303 - Easy Textillate Plugin
The Easy Textillate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'textillate' shortcode in all versions up to, and including, 2.01 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Easy Textillate
CVE-2024-2303
Risk Score
Threat Entry
Updated 2025-04-01
CVE-2024-2170 - Vk All In One Expansion Unit Plugin
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the child page index widget in all versions up to, and including, 9.96.0.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'className.' This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Vk All In One Expansion Unit
CVE-2024-2170
Risk Score
Threat Entry
Updated 2025-05-07
CVE-2024-1745 - Testimonial Slider Plugin
The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial Slider WordPress plugin before 2.3.7 settings, making it possible for users with at least the Author role to edit them.
PLUGIN
Testimonial Slider
CVE-2024-1745
Risk Score
Threat Entry
Updated 2025-05-07
CVE-2023-7232 - Backup And Restore Wordpress Plugin
The Backup and Restore WordPress WordPress plugin through 1.45 does not protect some log files containing sensitive information such as site configuration etc, allowing unauthenticated users to access such data
PLUGIN
Backup And Restore Wordpress
CVE-2023-7232
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-0866 - Check & Log Email Plugin
The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement.
PLUGIN
Check & Log Email
CVE-2024-0866
Risk Score
Threat Entry
Updated 2025-03-06
CVE-2024-2732 - Themify Shortcodes Plugin
The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'themify_post_slider shortcode in all versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Themify Shortcodes
CVE-2024-2732
Risk Score
Threat Entry
Updated 2025-12-05
CVE-2024-28850 - Wp Crontrol Plugin
WP Crontrol controls the cron events on WordPress websites. WP Crontrol includes a feature that allows administrative users to create events in the WP-Cron system that store and execute PHP code subject to the restrictive security permissions documented here. While there is no known vulnerability in this feature on its own, there exists potential for this feature to be vulnerable to RCE if it were specifically targeted via vulnerability chaining that exploited a separate SQLi (or similar) vulnerability. This is exploitable on a site if one of the below preconditions…
PLUGIN
Wp Crontrol
CVE-2024-28850
Risk Score
Threat Entry
Updated 2025-04-01
CVE-2024-1962 - Cm Download Manager Plugin
The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF attack
PLUGIN
Cm Download Manager
CVE-2024-1962
Risk Score
Threat Entry
Updated 2025-04-01
CVE-2024-1231 - Cm Download Manager Plugin
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack
PLUGIN
Cm Download Manager
CVE-2024-1231
Risk Score
Threat Entry
Updated 2025-04-01
CVE-2024-1232 - Cm Download Manager Plugin
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete downloads via a CSRF attack
PLUGIN
Cm Download Manager
CVE-2024-1232
Risk Score
Threat Entry
Updated 2025-06-27
CVE-2024-1564 - Wp Schema Pro Plugin
The wp-schema-pro WordPress plugin before 2.7.16 does not validate post access allowing a contributor user to access custom fields on any post regardless of post type or status via a shortcode
PLUGIN
Wp Schema Pro
CVE-2024-1564
Risk Score
Threat Entry
Updated 2025-02-13
CVE-2024-1049 - Coblocks Plugin
The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Widget's in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on the link value. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Coblocks
CVE-2024-1049
Risk Score
Threat Entry
Updated 2025-02-13
CVE-2024-2326 - Prettylinks Plugin
The Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to change the plugin's configuration including stripe integration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Prettylinks
CVE-2024-2326
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-2688 - Embedpress Plugin
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the EmbedPress document widget in all versions up to, and including, 3.9.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Embedpress
CVE-2024-2688
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-2468 - Embedpress Plugin
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the EmbedPress widget 'embedpress_pro_twitch_theme ' attribute in all versions up to, and including, 3.9.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Embedpress
CVE-2024-2468
Risk Score
Threat Entry
Updated 2025-02-13
CVE-2024-2202 - Page Builder Plugin
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the legacy Image widget in all versions up to, and including, 2.29.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Page Builder
CVE-2024-2202
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2025 - BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages Plugin
The "BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages" plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.20 via deserialization of untrusted input in the get_simple_request function. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
PLUGIN
BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages
CVE-2024-2025
Risk Score
Threat Entry
Updated 2025-01-27
CVE-2024-2131 - Move Addons For Elementor Plugin
The Move Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's infobox and button widget in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Move Addons For Elementor
CVE-2024-2131
Risk Score
Threat Entry
Updated 2025-02-13
CVE-2024-1697 - Custom Woocommerce Checkout Fields Editor Plugin
The Custom WooCommerce Checkout Fields Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the save_wcfe_options function in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Custom Woocommerce Checkout Fields Editor
CVE-2024-1697
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-2500 - Colormag Theme
The ColorMag theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authentciated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
Colormag
CVE-2024-2500
Risk Score