CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2024-1076 |
Description: The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to prevent visitors from accessing the site's generated private keys, which allows an attacker to read them if the site runs on a server who doesn't support .htaccess files, like NGINX.
CVSS: MEDIUM (6.5) EPSS Score: 0.11% SSVC Exploitation: poc
March 25th, 2025 (3 months ago)
|
|
CVE-2024-0677 |
Description: The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.
CVSS: MEDIUM (5.1) EPSS Score: 0.07% SSVC Exploitation: poc
March 25th, 2025 (3 months ago)
|
|
CVE-2024-37227 |
Description: Cross Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters.This issue affects Newsletters: from n/a through 4.9.7.
CVSS: MEDIUM (4.3) EPSS Score: 0.04% SSVC Exploitation: none
March 25th, 2025 (3 months ago)
|
|
CVE-2025-26742 |
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery for Social Photo allows Stored XSS.This issue affects Gallery for Social Photo: from n/a through 1.0.0.35.
CVSS: MEDIUM (6.5) EPSS Score: 0.03% SSVC Exploitation: none
March 25th, 2025 (3 months ago)
|
|
CVE-2024-31120 |
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Stored XSS.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
CVSS: MEDIUM (6.5) EPSS Score: 0.09% SSVC Exploitation: none
March 25th, 2025 (3 months ago)
|
|
CVE-2024-30493 |
Description: Cross-Site Request Forgery (CSRF) vulnerability in Andy Moyle Church Admin.This issue affects Church Admin: from n/a through 4.1.7.
CVSS: MEDIUM (4.3) EPSS Score: 0.04% SSVC Exploitation: none
March 25th, 2025 (3 months ago)
|
|
CVE-2024-30469 |
Description: Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0.
CVSS: MEDIUM (5.3) EPSS Score: 0.14% SSVC Exploitation: none
March 25th, 2025 (3 months ago)
|
|
CVE-2024-30451 |
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INFINITUM FORM Geo Controller allows Stored XSS.This issue affects Geo Controller: from n/a through 8.6.4.
CVSS: MEDIUM (6.5) EPSS Score: 0.08% SSVC Exploitation: none
March 25th, 2025 (3 months ago)
|
|
CVE-2024-2476 |
Description: The OceanWP theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_theme_panel_pane function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose sensitive information such as system/environment data and API keys.
CVSS: MEDIUM (4.3) EPSS Score: 0.17% SSVC Exploitation: none
March 25th, 2025 (3 months ago)
|
|
CVE-2024-1692 |
Description: The BoldGrid Easy SEO – Simple and Effective SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the meta description field in all versions up to, and including, 1.6.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS: MEDIUM (6.4) EPSS Score: 0.09% SSVC Exploitation: none
March 25th, 2025 (3 months ago)
|