CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2024-13627	WP Touch Slider <= 2.2 - Reflected XSS Description: The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. CVSS: MEDIUM (4.7) EPSS Score: 0.05% Source: CVE February 18th, 2025 (4 months ago)
CVE-2024-13608	Track Logins <= 1.0 - Admin+ SQL Injection Description: The Track Logins WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks CVSS: MEDIUM (4.7) EPSS Score: 0.03% Source: CVE February 18th, 2025 (4 months ago)
CVE-2025-26779	WordPress Keep Backup Daily plugin <= 2.1.0 - Arbitrary File Download vulnerability Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fahad Mahmood Keep Backup Daily allows Path Traversal. This issue affects Keep Backup Daily: from n/a through 2.1.0. CVSS: MEDIUM (4.9) EPSS Score: 0.04% Source: CVE February 17th, 2025 (4 months ago)
CVE-2025-26767	WordPress Qubely – Advanced Gutenberg Blocks plugin <= 1.8.12 - Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely – Advanced Gutenberg Blocks allows Stored XSS. This issue affects Qubely – Advanced Gutenberg Blocks: from n/a through 1.8.12. CVSS: MEDIUM (6.5) EPSS Score: 0.04% Source: CVE February 17th, 2025 (4 months ago)
CVE-2025-26766	WordPress Leyka plugin <= 3.31.8 - Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka allows Stored XSS. This issue affects Leyka: from n/a through 3.31.8. CVSS: MEDIUM (6.5) EPSS Score: 0.04% Source: CVE February 17th, 2025 (4 months ago)
CVE-2025-26765	WordPress Distance Based Shipping Calculator plugin <= 2.0.22 - Broken Access Control vulnerability Description: Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Distance Based Shipping Calculator: from n/a through 2.0.22. CVSS: MEDIUM (5.4) EPSS Score: 0.04% Source: CVE February 17th, 2025 (4 months ago)
CVE-2025-26761	WordPress Easy Elementor Addons plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Easy Elementor Addons allows DOM-Based XSS. This issue affects Easy Elementor Addons: from n/a through 2.1.5. CVSS: MEDIUM (6.5) EPSS Score: 0.04% Source: CVE February 17th, 2025 (4 months ago)
CVE-2025-23975	WordPress Botnet Attack Blocker plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Botnet Attack Blocker allows Stored XSS. This issue affects Botnet Attack Blocker: from n/a through 2.0.0. CVSS: MEDIUM (6.5) EPSS Score: 0.04% Source: CVE February 17th, 2025 (4 months ago)
CVE-2025-22689	WordPress Forex Calculators plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Levan Tarbor Forex Calculators allows Stored XSS. This issue affects Forex Calculators: from n/a through 1.3.6. CVSS: MEDIUM (6.5) EPSS Score: 0.04% Source: CVE February 17th, 2025 (4 months ago)
CVE-2025-22676	WordPress Upcasted S3 Offload plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in upcasted AWS S3 for WordPress Plugin – Upcasted allows Stored XSS. This issue affects AWS S3 for WordPress Plugin – Upcasted: from n/a through 3.0.3. CVSS: MEDIUM (6.5) EPSS Score: 0.04% Source: CVE February 17th, 2025 (4 months ago)