Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-05-05
CVE-2024-1401 - Profile Box Shortcode And Widget Plugin
The Profile Box Shortcode And Widget WordPress plugin before 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Profile Box Shortcode And Widget
CVE-2024-1401
Risk Score
Threat Entry
Updated 2026-01-28
CVE-2024-29142 - Better Search Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebberZone Better Search – Relevant search results for WordPress allows Stored XSS.This issue affects Better Search – Relevant search results for WordPress: from n/a through 3.3.0.
PLUGIN
Better Search
CVE-2024-29142
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2024-0858 - Innovs Hr Plugin
The Innovs HR WordPress plugin through 1.0.3.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees.
PLUGIN
Innovs Hr
CVE-2024-0858
Risk Score
Threat Entry
Updated 2025-03-14
CVE-2024-0780 - Enjoy Social Feed Plugin
The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation when resetting its database, allowing any authenticated users, such as subscriber to perform such action
PLUGIN
Enjoy Social Feed
CVE-2024-0780
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2024-0779 - Enjoy Social Feed Plugin
The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function hooked to admin_init, allowing unauthenticated users to call them and unlink arbitrary users Instagram Account for example
PLUGIN
Enjoy Social Feed
CVE-2024-0779
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2024-0365 - Fancy Product Designer Plugin
The Fancy Product Designer WordPress plugin before 6.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by adminstrators.
PLUGIN
Fancy Product Designer
CVE-2024-0365
Risk Score
Threat Entry
Updated 2025-03-27
CVE-2023-6821 - Error Log Viewer By Bestwebsoft Plugin
The Error Log Viewer by BestWebSoft WordPress plugin before 1.1.3 is affected by a Directory Listing issue, allowing users to read and download PHP logs without authorization
PLUGIN
Error Log Viewer By Bestwebsoft
CVE-2023-6821
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2024-0973 - Widget For Social Page Feeds Plugin
The Widget for Social Page Feeds WordPress plugin before 6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Widget For Social Page Feeds
CVE-2024-0973
Risk Score
Threat Entry
Updated 2025-05-13
CVE-2024-0711 - Buttons Shortcode And Widget Plugin
The Buttons Shortcode and Widget WordPress plugin through 1.16 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Buttons Shortcode And Widget
CVE-2024-0711
Risk Score
Threat Entry
Updated 2025-03-28
CVE-2024-0820 - Jobs For Plugin
The Jobs for WordPress plugin before 2.7.4 does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
PLUGIN
Jobs For
CVE-2024-0820
Risk Score
Threat Entry
Updated 2025-05-13
CVE-2024-0719 - Tabs Shortcode And Widget Plugin
The Tabs Shortcode and Widget WordPress plugin through 1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Tabs Shortcode And Widget
CVE-2024-0719
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2023-7085 - Through 3 Plugin
The Scalable Vector Graphics (SVG) WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
PLUGIN
Through 3
CVE-2023-7085
Risk Score
Threat Entry
Updated 2025-03-27
CVE-2024-0951 - Advanced Social Feeds Widget Shortcode Plugin
The Advanced Social Feeds Widget & Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Advanced Social Feeds Widget Shortcode
CVE-2024-0951
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2023-7236 - Backup Bolt Plugin
The Backup Bolt WordPress plugin through 1.3.0 is vulnerable to Information Exposure via the unprotected access of debug logs. This makes it possible for unauthenticated attackers to retrieve the debug log which may contain information like system errors which could contain sensitive information.
PLUGIN
Backup Bolt
CVE-2023-7236
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2024-1331 - Team Members Plugin
The Team Members WordPress plugin before 5.3.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Team Members
CVE-2024-1331
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2024-1658 - Grid Shortcodes Plugin
The Grid Shortcodes WordPress plugin before 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Grid Shortcodes
CVE-2024-1658
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2024-1333 - Responsive Pricing Table Plugin
The Responsive Pricing Table WordPress plugin before 5.1.11 does not validate and escape some of its Pricing Table options before outputting them back in a page/post where the related shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks
PLUGIN
Responsive Pricing Table
CVE-2024-1333
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-1857 - ultimate_gift_cards_for_woocommerce Plugin
The Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.6 via the wps_wgm_preview_email_template(). This makes it possible for unauthenticated attackers to read password protected and draft posts that may contain sensitive data.
PLUGIN
ultimate_gift_cards_for_woocommerce
CVE-2024-1857
Risk Score
Threat Entry
Updated 2025-04-18
CVE-2024-1733 - Word Replacer Pro Plugin
The Word Replacer Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the word_replacer_ultra() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to update arbitrary content on the affected WordPress site.
PLUGIN
Word Replacer Pro
CVE-2024-1733
Risk Score
Threat Entry
Updated 2025-04-18
CVE-2024-1685 - Social Media Share Buttons Plugin
The Social Media Share Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.0 via deserialization of untrusted input through the attachmentUrl parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
PLUGIN
Social Media Share Buttons
CVE-2024-1685
Risk Score