CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2024-6712	MapFig Studio <= 0.2.1 - Stored XSS via CSRF Description: The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-6711	Event Tickets with Ticket Scanner < 2.3.8 - Admin+ Stored XSS Description: The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks EPSS Score: 0.01% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-6693	WP Content Copy Protection & No Right Click (premium) <= 15.0 - Admin+ Stored XSS Description: The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) EPSS Score: 0.01% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-6668	profilepro <= 1.3 - Subscriber+ Stored Cross Site Scripting Description: The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-6667	kbucket < 4.1.5 - Reflected XSS Description: The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin. EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-6665	kbucket < 4.1.6 - Admin+ Stored XSS Description: The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) EPSS Score: 0.02% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-6486	ImageMagick Engine < 1.7.11 - Administrator+ OS Command Injection Description: The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_path" parameter. This allows authenticated attackers, with administrator-level permission to execute arbitrary OS commands on the server leading to remote code execution. EPSS Score: 0.41% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-6478	CTT Expresso para WooCommerce < 3.2.13 - Admin+ Stored XSS Description: The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-5440	If-So Dynamic Content Personalization < 1.8.0.3 - Contributor+ Shortcode Stored XSS Description: The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-5026	CM Tooltip Glossary < 4.3.4 - Admin+ Stored XSS Description: The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)