Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2024-6719 |
Description: The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update them via a CSRF attack
CVSS: HIGH (8.1) EPSS Score: 0.04%
May 15th, 2025 (23 days ago)
|
|
CVE-2024-12767 |
Description: The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts
CVSS: HIGH (7.5) EPSS Score: 0.04%
May 15th, 2025 (23 days ago)
|
|
CVE-2024-0970 |
Description: This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.
CVSS: HIGH (7.5) EPSS Score: 0.1%
May 15th, 2025 (23 days ago)
|
|
CVE-2024-0324 |
Description: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wppb_two_factor_authentication_settings_update' function in all versions up to, and including, 3.10.8. This makes it possible for unauthenticated attackers to enable or disable the 2FA functionality present in the Premium version of the plugin for arbitrary user roles.
CVSS: HIGH (8.2) EPSS Score: 45.96% SSVC Exploitation: none
May 15th, 2025 (23 days ago)
|
|
CVE-2025-32922 |
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tobias WP2LEADS allows Stored XSS.This issue affects WP2LEADS: from n/a through 3.5.0.
CVSS: HIGH (7.1) EPSS Score: 0.02% SSVC Exploitation: none
May 15th, 2025 (23 days ago)
|
|
CVE-2024-22293 |
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrea Tarantini BP Profile Search allows Reflected XSS.This issue affects BP Profile Search: from n/a through 5.5.
CVSS: HIGH (7.1) EPSS Score: 0.06% SSVC Exploitation: none
May 15th, 2025 (23 days ago)
|
|
CVE-2024-13914 |
Description: The File Manager Advanced Shortcode WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.4 (file-manager-advanced-shortcode) and 2.5.6 (advanced-file-manager-pro-premium), via the 'file_manager_advanced' shortcode. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary JavaScript files on the server. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Sites currently using 2.5.4 (file-manager-advanced-shortcode) should be updated to 2.6.0 (advanced-file-manager-pro-premium).
CVSS: HIGH (7.2) EPSS Score: 0.12%
May 15th, 2025 (24 days ago)
|
|
CVE-2025-3053 |
Description: The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.5.07 via the uip_process_form_input() function. This is due to the function taking user supplied inputs to execute arbitrary functions with arbitrary data, and does not have any sort of capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary code on the server.
CVSS: HIGH (8.8) EPSS Score: 0.29%
May 15th, 2025 (24 days ago)
|
|
CVE-2025-4579 |
Description: The WP Content Security Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blocked-uri and effective-directive parameters in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS: HIGH (7.2) EPSS Score: 0.12%
May 15th, 2025 (24 days ago)
|
|
CVE-2025-3623 |
Description: The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deserialization of untrusted input in the automator_api_decode_message() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files.
CVSS: HIGH (8.1) EPSS Score: 0.06% SSVC Exploitation: none
May 14th, 2025 (24 days ago)
|