CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2024-8085	PeoplePond <= 1.1.9 - CSRF to Stored XSS Description: The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. EPSS Score: 0.01% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-8032	Smooth Gallery Replacement <= 1.0 - CSRF to Stored XSS Description: The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. EPSS Score: 0.01% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-8031	Secure Downloads < 1.2.3 - Admin+ Arbitrary File Download Description: The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php. EPSS Score: 0.04% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-7758	Stylish Price List < 7.1.8 - Contributor+ Stored XSS Description: The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-6797	DL Robots.txt <= 1.2 - Admin+ Stored XSS Description: The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). EPSS Score: 0.02% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-6712	MapFig Studio <= 0.2.1 - Stored XSS via CSRF Description: The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-6711	Event Tickets with Ticket Scanner < 2.3.8 - Admin+ Stored XSS Description: The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks EPSS Score: 0.01% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-6693	WP Content Copy Protection & No Right Click (premium) <= 15.0 - Admin+ Stored XSS Description: The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) EPSS Score: 0.01% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-6668	profilepro <= 1.3 - Subscriber+ Stored Cross Site Scripting Description: The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-6667	kbucket < 4.1.5 - Reflected XSS Description: The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin. EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)