CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2024-9879	Website File Changes < 2.1.1 - Authenticated SQL Injection Description: The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-9709	EKC Tournament Manager < 2.2.2 - Create Tournaments/Teams via CSRF Description: The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack EPSS Score: 0.02% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-9663	CYAN Backup < 2.5.3 - Admin+ Stored XSS via Remote Storage Settings Description: The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-9662	CYAN Backup < 2.5.3 - Admin+ Stored XSS via General Settings Description: The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-9645	Post Grid and Gutenberg Blocks < 2.2.93 - Contributor+ Stored XSS Description: The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-9450	Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking < 1.3.15 - Subscriber+ PayPal Settings Update Description: The Free Booking Plugin for Hotels, Restaurants and Car Rentals WordPress plugin before 1.3.15 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in subscriber change them via a CSRF attack EPSS Score: 0.02% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-8703	Z-Downloads < 1.11.6 - Unauthenticated Stored XSS Description: The Z-Downloads WordPress plugin before 1.11.6 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks when accessing share URLs. EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-8700	Event Calendar <= 1.0.4 - Unauthenticated Arbitrary Calendar Deletion Description: The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars. EPSS Score: 0.04% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-8670	Photo Gallery by 10Web < 1.8.29 - Admin+ Stored XSS Description: The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). EPSS Score: 0.02% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-8397	GDPR Cookie Consent <= 2.6.0 - Unauthenticated Stored XSS Description: The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize and escape the IP headers when logging them, allowing visitors to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Consent report' page and the malicious script is executed in the admin context. EPSS Score: 0.01% Source: CVE May 15th, 2025 (about 1 month ago)