CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2024-10894	Payment Forms for Paystack <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Description: The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'datepicker', 'textarea', and 'text' in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVSS: MEDIUM (6.4) EPSS Score: 0.04% Source: CVE April 10th, 2025 (2 months ago)
CVE-2025-26902	WordPress Brizy Pro plugin <= 2.6.1 - Cross Site Request Forgery (CSRF) vulnerability Description: Cross-Site Request Forgery (CSRF) vulnerability in Brizy Brizy Pro allows Cross Site Request Forgery.This issue affects Brizy Pro: from n/a through 2.6.1. CVSS: MEDIUM (4.3) EPSS Score: 0.02% SSVC Exploitation: none Source: CVE April 9th, 2025 (2 months ago)
CVE-2025-26901	WordPress Brizy Pro plugin <= 2.6.1 - Broken Access Control vulnerability Description: Missing Authorization vulnerability in Brizy Brizy Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy Pro: from n/a through 2.6.1. CVSS: MEDIUM (4.3) EPSS Score: 0.04% SSVC Exploitation: none Source: CVE April 9th, 2025 (2 months ago)
CVE-2025-26888	WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.8 - Broken Access Control vulnerability Description: Missing Authorization vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.8. CVSS: MEDIUM (5.3) EPSS Score: 0.04% SSVC Exploitation: none Source: CVE April 9th, 2025 (2 months ago)
CVE-2025-32694	WordPress Ultimate WP Mail <= 1.3.2 - Open Redirection Vulnerability Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Rustaurius Ultimate WP Mail allows Phishing. This issue affects Ultimate WP Mail: from n/a through 1.3.2. CVSS: MEDIUM (4.7) EPSS Score: 0.03% Source: CVE April 9th, 2025 (2 months ago)
CVE-2025-32693	WordPress WebinarPress <= 1.33.27 - Open Redirection Vulnerability Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPWebinarSystem WebinarPress allows Phishing. This issue affects WebinarPress: from n/a through 1.33.27. CVSS: MEDIUM (4.7) EPSS Score: 0.03% Source: CVE April 9th, 2025 (2 months ago)
CVE-2025-32691	WordPress PowerPress Podcasting <= 11.12.4 - Server Side Request Forgery (SSRF) Vulnerability Description: Server-Side Request Forgery (SSRF) vulnerability in Angelo Mandato PowerPress Podcasting allows Server Side Request Forgery. This issue affects PowerPress Podcasting: from n/a through 11.12.4. CVSS: MEDIUM (4.9) EPSS Score: 0.03% Source: CVE April 9th, 2025 (2 months ago)
CVE-2025-32690	WordPress PowerPress Podcasting <= 11.12.4 - Cross Site Scripting (XSS) Vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Angelo Mandato PowerPress Podcasting allows DOM-Based XSS. This issue affects PowerPress Podcasting: from n/a through 11.12.4. CVSS: MEDIUM (6.5) EPSS Score: 0.03% Source: CVE April 9th, 2025 (2 months ago)
CVE-2025-32684	WordPress MapSVG Lite plugin <= 8.5.32 - Broken Access Control Vulnerability Description: Missing Authorization vulnerability in RomanCode MapSVG Lite allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MapSVG Lite: from n/a through 8.5.32. CVSS: MEDIUM (5.0) EPSS Score: 0.03% Source: CVE April 9th, 2025 (2 months ago)
CVE-2025-32683	WordPress MapSVG Lite plugin <= 8.5.32 - Cross Site Scripting (XSS) Vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG Lite allows DOM-Based XSS. This issue affects MapSVG Lite: from n/a through 8.5.32. CVSS: MEDIUM (6.5) EPSS Score: 0.03% Source: CVE April 9th, 2025 (2 months ago)