CyberAlerts

CVE-2024-10054

Description: The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS: MEDIUM (4.8)

EPSS Score: 0.03%

Source: CVE

May 15th, 2025 (24 days ago)

CVE-2024-0852

coreActivity < 1.8.1 - Unauthenticated Stored XSS

Description: The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated users to perform Stored XSS attack against high privilege users such as admin

CVSS: MEDIUM (6.1)

EPSS Score: 0.14%

Source: CVE

May 15th, 2025 (24 days ago)

CVE-2024-0249

Advanced Schedule Posts <= 2.1.8 - Reflected XSS

Description: The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins.

CVSS: MEDIUM (6.1)

EPSS Score: 0.09%

Source: CVE

May 15th, 2025 (24 days ago)

CVE-2024-1110

The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

Description: The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to import the plugin's settings.

CVSS: MEDIUM (5.3)

EPSS Score: 0.15%

SSVC Exploitation: none

Source: CVE

May 15th, 2025 (24 days ago)

CVE-2024-0797

The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to unauthorized...

Description: The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 1.0.6.1. This makes it possible for subscribers and higher to execute functions intended for admin use.

CVSS: MEDIUM (4.3)

EPSS Score: 0.13%

SSVC Exploitation: none

Source: CVE

May 15th, 2025 (24 days ago)

CVE-2024-0699

The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file...

Description: The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_image_from_url' function in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with Editor access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS: MEDIUM (6.6)

EPSS Score: 5.37%

SSVC Exploitation: none

Source: CVE

May 15th, 2025 (24 days ago)

CVE-2024-56006

WordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerability

Description: Missing Authorization vulnerability in Automattic Jetpack Debug Tools.This issue affects Jetpack Debug Tools: from n/a before 2.0.1.

CVSS: MEDIUM (5.3)

EPSS Score: 0.04%

Source: CVE

May 15th, 2025 (24 days ago)

CVE-2024-51666

WordPress Tours plugin <= 1.0.0 - Broken Access Control vulnerability

Description: Missing Authorization vulnerability in Automattic Tours.This issue affects Tours: from n/a through 1.0.0.

CVSS: MEDIUM (4.3)

EPSS Score: 0.03%

Source: CVE

May 15th, 2025 (24 days ago)

CVE-2025-47580

WordPress Front End Users plugin <= 3.2.32 - Sensitive Data Exposure vulnerability

Description: Missing Authorization vulnerability in Rustaurius Front End Users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Front End Users: from n/a through 3.2.32.

CVSS: MEDIUM (5.4)

EPSS Score: 0.04%

Source: CVE

May 15th, 2025 (24 days ago)

CVE-2024-22306

WordPress Mang Board WP Plugin <= 1.7.7 is vulnerable to Cross Site Scripting (XSS)

Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hometory Mang Board WP allows Stored XSS.This issue affects Mang Board WP: from n/a through 1.7.7.

CVSS: MEDIUM (5.9)

EPSS Score: 0.04%

SSVC Exploitation: none

Source: CVE

May 15th, 2025 (24 days ago)

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2024-10054	Happyforms < 1.26.3 - Admin+ Stored XSS Description: The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). CVSS: MEDIUM (4.8) EPSS Score: 0.03% Source: CVE May 15th, 2025 (24 days ago)
CVE-2024-0852	coreActivity < 1.8.1 - Unauthenticated Stored XSS Description: The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated users to perform Stored XSS attack against high privilege users such as admin CVSS: MEDIUM (6.1) EPSS Score: 0.14% Source: CVE May 15th, 2025 (24 days ago)
CVE-2024-0249	Advanced Schedule Posts <= 2.1.8 - Reflected XSS Description: The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins. CVSS: MEDIUM (6.1) EPSS Score: 0.09% Source: CVE May 15th, 2025 (24 days ago)
CVE-2024-1110	The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the... Description: The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to import the plugin's settings. CVSS: MEDIUM (5.3) EPSS Score: 0.15% SSVC Exploitation: none Source: CVE May 15th, 2025 (24 days ago)
CVE-2024-0797	The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to unauthorized... Description: The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 1.0.6.1. This makes it possible for subscribers and higher to execute functions intended for admin use. CVSS: MEDIUM (4.3) EPSS Score: 0.13% SSVC Exploitation: none Source: CVE May 15th, 2025 (24 days ago)
CVE-2024-0699	The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file... Description: The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_image_from_url' function in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with Editor access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSS: MEDIUM (6.6) EPSS Score: 5.37% SSVC Exploitation: none Source: CVE May 15th, 2025 (24 days ago)
CVE-2024-56006	WordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerability Description: Missing Authorization vulnerability in Automattic Jetpack Debug Tools.This issue affects Jetpack Debug Tools: from n/a before 2.0.1. CVSS: MEDIUM (5.3) EPSS Score: 0.04% Source: CVE May 15th, 2025 (24 days ago)
CVE-2024-51666	WordPress Tours plugin <= 1.0.0 - Broken Access Control vulnerability Description: Missing Authorization vulnerability in Automattic Tours.This issue affects Tours: from n/a through 1.0.0. CVSS: MEDIUM (4.3) EPSS Score: 0.03% Source: CVE May 15th, 2025 (24 days ago)
CVE-2025-47580	WordPress Front End Users plugin <= 3.2.32 - Sensitive Data Exposure vulnerability Description: Missing Authorization vulnerability in Rustaurius Front End Users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Front End Users: from n/a through 3.2.32. CVSS: MEDIUM (5.4) EPSS Score: 0.04% Source: CVE May 15th, 2025 (24 days ago)
CVE-2024-22306	WordPress Mang Board WP Plugin <= 1.7.7 is vulnerable to Cross Site Scripting (XSS) Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hometory Mang Board WP allows Stored XSS.This issue affects Mang Board WP: from n/a through 1.7.7. CVSS: MEDIUM (5.9) EPSS Score: 0.04% SSVC Exploitation: none Source: CVE May 15th, 2025 (24 days ago)