CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2024-10504	ARForms Builder < 1.7.1 - Unauthenticated Stored XSS Description: The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks. EPSS Score: 0.05% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-10475	Lead Form Builder < 1.9.8 - Admin+ Stored XSS Description: The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-10362	Social Media Share Buttons < 2.9.0 - Admin+ Stored XSS Description: The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-10149	Social Slider Feed < 2.2.9 - Admin+ Stored XSS via Widgets Description: The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-10144	Photo Gallery, Images, Slider in Rbs Image Gallery < 3.2.22 - Contributor+ Stored XSS Description: The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-10143	MB Custom Post Types & Custom Taxonomies < 2.7.7 - Admin+ Stored XSS Description: The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-10107	Giveaways and Contests by RafflePress < 1.12.17 - Admin+ Stored XSS Description: The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-10075	Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution Description: The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block. EPSS Score: 0.05% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-10009	Website File Changes < 2.1.0 - Admin+ Authenticated SQL Injection Description: The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
	Big Steelmaker Halts Operations After Cyber Incident Description: Nucor made it clear its investigation is still in the early stages and didn't specify the nature or scope of the breach, nor who the threat actor might be. Source: Dark Reading May 15th, 2025 (about 1 month ago)