Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-07-16
CVE-2024-0909 - Anonymous Restricted Content Plugin
The Anonymous Restricted Content plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.6.2. This is due to insufficient restrictions through the REST API on the posts/pages that protections are being place on. This makes it possible for unauthenticated attackers to access protected content.
PLUGIN
Anonymous Restricted Content
CVE-2024-0909
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-0895 - Pdf Flipbook 3d Flipbook Plugin
The PDF Flipbook, 3D Flipbook – DearFlip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via outline settings in all versions up to, and including, 2.2.26 due to insufficient input sanitization and output escaping on user supplied data. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Pdf Flipbook 3d Flipbook
CVE-2024-0895
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-0963 - Calculated Fields Form Plugin
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode in all versions up to, and including, 1.2.52 due to insufficient input sanitization and output escaping on user supplied 'location' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Calculated Fields Form
CVE-2024-0963
Risk Score
Threat Entry
Updated 2025-08-15
CVE-2024-0844 - Ai Popup Plugin
The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress is vulnerable to Local File Inclusion in version 2.1.6 via the ycfChangeElementData() function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary files ending with "Form.php" on the server , allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
PLUGIN
Ai Popup
CVE-2024-0844
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-1047 - Orbit Fox Plugin
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in all versions up to, and including, 2.10.28. This makes it possible for unauthenticated attackers to update the connected API keys.
PLUGIN
Orbit Fox
CVE-2024-1047
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-1162 - Orbit Fox Plugin
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.29. This is due to missing or incorrect nonce validation on the register_reference() function. This makes it possible for unauthenticated attackers to update the connected API keys via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Orbit Fox
CVE-2024-1162
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-1073 - Slimstat Analytics Plugin
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Slimstat Analytics
CVE-2024-1073
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-0685 - Ninja Forms Plugin
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection via the email address value submitted through forms in all versions up to, and including, 3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to inject SQL in their email address that will append additional into the already existing query when an administrator triggers a personal data export.
PLUGIN
Ninja Forms
CVE-2024-0685
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-51506 - Wordpress Currency Switcher Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WPCS – WordPress Currency Switcher Professional allows Stored XSS.This issue affects WPCS – WordPress Currency Switcher Professional: from n/a through 1.2.0.
PLUGIN
Wordpress Currency Switcher
CVE-2023-51506
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-51536 - Crm Perks Forms Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms – WordPress Form Builder allows Stored XSS.This issue affects CRM Perks Forms – WordPress Form Builder: from n/a through 1.1.2.
PLUGIN
Crm Perks Forms
CVE-2023-51536
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-51532 - Icegram Engage Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building allows Stored XSS.This issue affects Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: from n/a through 3.1.19.
PLUGIN
Icegram Engage
CVE-2023-51532
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-7069 - Advanced Iframe Plugin
The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2023.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-24870 is likely a duplicate of this issue.
PLUGIN
Advanced Iframe
CVE-2023-7069
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-22159 - Wolf Wordpress Posts Bulk Editor And Products Manager Professional Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional allows Reflected XSS.This issue affects WOLF – WordPress Posts Bulk Editor and Manager Professional: from n/a through 1.0.8.
PLUGIN
Wolf Wordpress Posts Bulk Editor And Products Manager Professional
CVE-2024-22159
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-22150 - Powerfolio Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PWR Plugins Portfolio & Image Gallery for WordPress | PowerFolio allows Stored XSS.This issue affects Portfolio & Image Gallery for WordPress | PowerFolio: from n/a through 3.1.
PLUGIN
Powerfolio
CVE-2024-22150
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-23508 - Pdf Poster Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster – PDF Embedder Plugin for WordPress allows Reflected XSS.This issue affects PDF Poster – PDF Embedder Plugin for WordPress: from n/a through 2.1.17.
PLUGIN
Pdf Poster
CVE-2024-23508
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-22304 - Freshmail For Wordpress Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Borbis Media FreshMail For WordPress.This issue affects FreshMail For WordPress: from n/a through 2.3.2.
PLUGIN
Freshmail For Wordpress
CVE-2024-22304
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-22305 - Kali Forms Plugin
Authorization Bypass Through User-Controlled Key vulnerability in ali Forms Contact Form builder with drag & drop for WordPress – Kali Forms.This issue affects Contact Form builder with drag & drop for WordPress – Kali Forms: from n/a through 2.3.36.
PLUGIN
Kali Forms
CVE-2024-22305
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2024-0836 - Review Schema Plugin
The WordPress Review & Structure Data Schema Plugin – Review Schema plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtrs_review_edit() function in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary reviews.
PLUGIN
Review Schema
CVE-2024-0836
Risk Score
Threat Entry
Updated 2025-05-29
CVE-2024-1069 - Database For Contact Form 7 Wpforms Elementor Forms Plugin
The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Database For Contact Form 7 Wpforms Elementor Forms
CVE-2024-1069
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2023-2439 - Userpro Plugin
The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Userpro
CVE-2023-2439
Risk Score