CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2024-12314	Rapid Cache <= 1.2.3 - Unauthenticated Cache Poisoning Description: The Rapid Cache plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 1.2.3. This is due to plugin storing HTTP headers in the cached data. This makes it possible for unauthenticated attackers to poison the cache with custom HTTP headers that may be unsanitized which can lead to Cross-Site Scripting. CVSS: HIGH (7.2) EPSS Score: 0.06% Source: CVE February 19th, 2025 (4 months ago)
CVE-2025-23845	WordPress ImageMeta Plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ERA404 ImageMeta allows Reflected XSS. This issue affects ImageMeta: from n/a through 1.1.2. CVSS: HIGH (7.1) EPSS Score: 0.04% Source: CVE February 18th, 2025 (4 months ago)
CVE-2025-23840	WordPress WP-NOTCAPTCHA Plugin <= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webjema WP-NOTCAPTCHA allows Reflected XSS. This issue affects WP-NOTCAPTCHA: from n/a through 1.3.1. CVSS: HIGH (7.1) EPSS Score: 0.04% Source: CVE February 18th, 2025 (4 months ago)
CVE-2025-0924	WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting Description: The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVSS: HIGH (7.2) EPSS Score: 9.61% Source: CVE February 18th, 2025 (4 months ago)
CVE-2024-13726	Themes Coder <= 1.3.4 - Unauthenticated SQLi Description: The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection CVSS: HIGH (8.6) EPSS Score: 18.98% Source: CVE February 18th, 2025 (4 months ago)
CVE-2024-13625	Tube Video Ads Lite <= 1.5.7 - Reflected XSS Description: The Tube Video Ads Lite WordPress plugin through 1.5.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. CVSS: HIGH (7.1) EPSS Score: 0.04% Source: CVE February 18th, 2025 (4 months ago)
CVE-2025-26768	WordPress what3words Address Field plugin <= 4.0.15 - CSRF to Stored XSS vulnerability Description: Cross-Site Request Forgery (CSRF) vulnerability in what3words what3words Address Field allows Stored XSS. This issue affects what3words Address Field: from n/a through 4.0.15. CVSS: HIGH (7.1) EPSS Score: 0.04% Source: CVE February 17th, 2025 (4 months ago)
CVE-2025-26759	WordPress Content Snippet Manager plugin <= 1.1.5 - CSRF to Stored XSS vulnerability Description: Cross-Site Request Forgery (CSRF) vulnerability in alexvtn Content Snippet Manager allows Stored XSS. This issue affects Content Snippet Manager: from n/a through 1.1.5. CVSS: HIGH (7.1) EPSS Score: 0.04% Source: CVE February 17th, 2025 (4 months ago)
CVE-2025-26755	WordPress WP Airbnb Review Slider Plugin <= 3.9 - SQL Injection vulnerability Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Airbnb Review Slider allows Blind SQL Injection. This issue affects WP Airbnb Review Slider: from n/a through 3.9. CVSS: HIGH (7.6) EPSS Score: 0.04% Source: CVE February 17th, 2025 (4 months ago)
CVE-2025-22680	WordPress Ad Inserter Pro plugin <= 2.7.39 - Reflected Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Ad Inserter Pro allows Reflected XSS. This issue affects Ad Inserter Pro: from n/a through 2.7.39. CVSS: HIGH (7.1) EPSS Score: 0.04% Source: CVE February 17th, 2025 (4 months ago)