CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2024-12726	ClipArt <= 0.2 - Reflected XSS Description: The ClipArt WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. CVSS: MEDIUM (6.1) EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-12724	WP DeskLite <= 1.0.0 - Reflected XSS Description: The WP DeskLite WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. CVSS: MEDIUM (6.1) EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-12722	Twitter Bootstrap Collapse aka Accordian Shortcode <= 1.0 - Stored XSS via Shortcode Description: The Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. CVSS: MEDIUM (5.4) EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-12301	JSP Store Locator <= 1.0 - Deletion via Missing CSRF Description: The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. CVSS: MEDIUM (6.5) EPSS Score: 0.01% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-11843	Panorama – WordPress Project Management Plugin <= 1.5.1 - Admin+ Stored XSS Description: The Panorama WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). CVSS: MEDIUM (4.8) EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-11373	Connexion Logs <= 3.0.2 - Log Deletion via CSRF Description: The Connexion Logs WordPress plugin through 3.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack CVSS: MEDIUM (4.3) EPSS Score: 0.01% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-11221	Full Screen (Page) Background Image Slideshow <= 1.1 - Admin+ Stored XSS Description: The Full Screen (Page) Background Image Slideshow WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). CVSS: MEDIUM (4.8) EPSS Score: 0.0% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-11190	jwp-a11y <= 4.1.7 - Admin+ Stored XSS Description: The jwp-a11y WordPress plugin through 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). CVSS: MEDIUM (4.8) EPSS Score: 0.02% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-11109	WP Google Review Slider < 15.6 - Admin+ Stored XSS Description: The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). CVSS: MEDIUM (4.8) EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-10677	BTEV <= 2.0.2 - Settings Update via CSRF Description: The BTEV WordPress plugin through 2.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack CVSS: MEDIUM (4.3) EPSS Score: 0.01% Source: CVE May 15th, 2025 (about 1 month ago)