Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-01-08
CVE-2024-0766 - Envo S Elementor Templates Widgets For Woocommerce Plugin
The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the templates_ajax_request function in all versions up to, and including, 1.4.4. This makes it possible for subscribers and higher to create templates.
PLUGIN
Envo S Elementor Templates Widgets For Woocommerce
CVE-2024-0766
Risk Score
Threat Entry
Updated 2025-02-10
CVE-2024-0433 - Gestpay For Woocommerce Plugin
The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to missing or incorrect nonce validation on the 'ajax_unset_default_card' function. This makes it possible for unauthenticated attackers to remove the default status of a card token for a user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Gestpay For Woocommerce
CVE-2024-0433
Risk Score
Threat Entry
Updated 2025-02-10
CVE-2024-0432 - Gestpay For Woocommerce Plugin
The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to missing or incorrect nonce validation on the 'ajax_delete_card' function. This makes it possible for unauthenticated attackers to delete the default card token for a user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Gestpay For Woocommerce
CVE-2024-0432
Risk Score
Threat Entry
Updated 2025-02-25
CVE-2024-0431 - Gestpay For Woocommerce Plugin
The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to missing or incorrect nonce validation on the 'ajax_set_default_card' function. This makes it possible for unauthenticated attackers to set the default card token for a user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Gestpay For Woocommerce
CVE-2024-0431
Risk Score
Threat Entry
Updated 2025-02-07
CVE-2023-6922 - Under Construction Maintenance Mode Plugin
The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.6 via the 'acx_csma_subscribe_ajax' function. This can allow authenticated attackers to extract sensitive data such as names and email addresses of subscribed visitors.
PLUGIN
Under Construction Maintenance Mode
CVE-2023-6922
Risk Score
Threat Entry
Updated 2025-01-08
CVE-2024-1943 - Yuki Plugin
The Yuki theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 1.3.14. This is due to missing or incorrect nonce validation on the reset_customizer_options() function. This makes it possible for unauthenticated attackers to reset the themes settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Yuki
CVE-2024-1943
Risk Score
Threat Entry
Updated 2025-01-16
CVE-2024-1568 - Seraphinite Accelerator Plugin
The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 via the OnAdminApi_HtmlCheck function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
PLUGIN
Seraphinite Accelerator
CVE-2024-1568
Risk Score
Threat Entry
Updated 2025-01-16
CVE-2024-1388 - Yuki Plugin
The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_customizer_options() function in all versions up to, and including, 1.3.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to reset the theme's settings.
PLUGIN
Yuki
CVE-2024-1388
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1912 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxUpdateFolderPosition function. This makes it possible for unauthenticated attackers to update the folder position of categories as well as update the metadata of other taxonomies via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Categorify
CVE-2024-1912
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1910 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxClearCategory function. This makes it possible for unauthenticated attackers to clear categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Categorify
CVE-2024-1910
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1909 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxRenameCategory function. This makes it possible for unauthenticated attackers to rename categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Categorify
CVE-2024-1909
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1907 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxDeleteCategory function. This makes it possible for unauthenticated attackers to delete categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Categorify
CVE-2024-1907
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1906 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxAddCategory function. This makes it possible for unauthenticated attackers to add categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Categorify
CVE-2024-1906
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1653 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxUpdateFolderPosition in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the folder position of categories as well as update the metadata of other taxonomies.
PLUGIN
Categorify
CVE-2024-1653
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1652 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxClearCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear categories.
PLUGIN
Categorify
CVE-2024-1652
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1650 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxRenameCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to rename categories.
PLUGIN
Categorify
CVE-2024-1650
Risk Score
Threat Entry
Updated 2025-01-07
CVE-2024-1649 - Categorify Plugin
The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxDeleteCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete categories.
PLUGIN
Categorify
CVE-2024-1649
Risk Score
Threat Entry
Updated 2025-05-01
CVE-2023-7165 - Before 2 Plugin
The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files.
PLUGIN
Before 2
CVE-2023-7165
Risk Score
Threat Entry
Updated 2025-05-01
CVE-2023-6585 - Wp Jobsearch Plugin
The WP JobSearch WordPress plugin before 2.3.4 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server
PLUGIN
Wp Jobsearch
CVE-2023-6585
Risk Score
Threat Entry
Updated 2025-05-01
CVE-2023-6584 - Wp Jobsearch Plugin
The WP JobSearch WordPress plugin before 2.3.4 does not prevent attackers from logging-in as any users with the only knowledge of that user's email address.
PLUGIN
Wp Jobsearch
CVE-2023-6584
Risk Score