Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2025-1525	Ultimate Dashboard < 3.8.6 - Admin+ Stored XSS Description: The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Source: CVE April 17th, 2025 (about 14 hours ago)
CVE-2025-1524	Ultimate Dashboard < 3.8.6 - Admin+ Stored XSS Description: The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Source: CVE April 17th, 2025 (about 14 hours ago)
CVE-2025-1523	Ultimate Dashboard < 3.8.6 - Admin+ Stored XSS Description: The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Source: CVE April 17th, 2025 (about 14 hours ago)
CVE-2024-13925	Klarna Checkout for WooCommerce < 2.13.5 - DoS via Excessive Logging Description: The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per request. This can result in rapid consumption of disk space, potentially filling the entire disk. Source: CVE April 17th, 2025 (about 14 hours ago)
CVE-2024-11924	Email Subscribers < 5.7.52 - Admin+ Stored XSS Description: The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Source: CVE April 17th, 2025 (about 14 hours ago)
CVE-2024-10680	Form Maker by 10Web < 1.15.32 - Admin+ Stored XSS Description: The Form Maker by 10Web WordPress plugin before 1.15.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). EPSS Score: 0.02% Source: CVE April 16th, 2025 (1 day ago)
CVE-2024-13610	Simple Social Media Share Buttons < 6.0.0 - Admin+ Stored XSS Description: The Simple Social Media Share Buttons WordPress plugin before 6.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). EPSS Score: 0.03% Source: CVE April 15th, 2025 (3 days ago)
CVE-2024-13207	Widget for Social Page Feeds < 6.4.2 - Admin+ Stored XSS Description: The Widget for Social Page Feeds WordPress plugin before 6.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). EPSS Score: 0.03% Source: CVE April 15th, 2025 (3 days ago)
CVE-2025-2563	User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation Description: The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges EPSS Score: 11.25% Source: CVE April 14th, 2025 (4 days ago)
CVE-2024-9230	PowerPress Podcasting < 11.9.18 - Author+ XSS via Podcast URL Description: The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow author and above users to perform Stored Cross-Site Scripting attacks EPSS Score: 0.03% Source: CVE April 14th, 2025 (4 days ago)