Threat and Vulnerability Intelligence Database

RSS Feed

Example Searches:

CVE-2024-6719

Description: The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update them via a CSRF attack

CVSS: HIGH (8.1)

EPSS Score: 0.04%

Source: CVE
May 15th, 2025 (23 days ago)

CVE-2024-12767

Description: The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts

CVSS: HIGH (7.5)

EPSS Score: 0.04%

Source: CVE
May 15th, 2025 (23 days ago)

CVE-2024-0970

Description: This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.

CVSS: HIGH (7.5)

EPSS Score: 0.1%

Source: CVE
May 15th, 2025 (23 days ago)

CVE-2024-0324

Description: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wppb_two_factor_authentication_settings_update' function in all versions up to, and including, 3.10.8. This makes it possible for unauthenticated attackers to enable or disable the 2FA functionality present in the Premium version of the plugin for arbitrary user roles.

CVSS: HIGH (8.2)

EPSS Score: 45.96%

SSVC Exploitation: none

Source: CVE
May 15th, 2025 (23 days ago)

CVE-2025-32922

Description: Cross-Site Request Forgery (CSRF) vulnerability in Tobias WP2LEADS allows Stored XSS.This issue affects WP2LEADS: from n/a through 3.5.0.

CVSS: HIGH (7.1)

EPSS Score: 0.02%

SSVC Exploitation: none

Source: CVE
May 15th, 2025 (23 days ago)

CVE-2024-22293

Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrea Tarantini BP Profile Search allows Reflected XSS.This issue affects BP Profile Search: from n/a through 5.5.

CVSS: HIGH (7.1)

EPSS Score: 0.06%

SSVC Exploitation: none

Source: CVE
May 15th, 2025 (23 days ago)

CVE-2024-13914

Description: The File Manager Advanced Shortcode WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.4 (file-manager-advanced-shortcode) and 2.5.6 (advanced-file-manager-pro-premium), via the 'file_manager_advanced' shortcode. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary JavaScript files on the server. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Sites currently using 2.5.4 (file-manager-advanced-shortcode) should be updated to 2.6.0 (advanced-file-manager-pro-premium).

CVSS: HIGH (7.2)

EPSS Score: 0.12%

Source: CVE
May 15th, 2025 (24 days ago)

CVE-2025-3053

Description: The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.5.07 via the uip_process_form_input() function. This is due to the function taking user supplied inputs to execute arbitrary functions with arbitrary data, and does not have any sort of capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary code on the server.

CVSS: HIGH (8.8)

EPSS Score: 0.29%

Source: CVE
May 15th, 2025 (24 days ago)

CVE-2025-4579

Description: The WP Content Security Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blocked-uri and effective-directive parameters in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS: HIGH (7.2)

EPSS Score: 0.12%

Source: CVE
May 15th, 2025 (24 days ago)

CVE-2025-3623

Description: The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deserialization of untrusted input in the automator_api_decode_message() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files.

CVSS: HIGH (8.1)

EPSS Score: 0.06%

SSVC Exploitation: none

Source: CVE
May 14th, 2025 (24 days ago)