CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2024-10143 |
Description: The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
EPSS Score: 0.03%
May 15th, 2025 (about 1 month ago)
|
|
CVE-2024-10107 |
Description: The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
EPSS Score: 0.03%
May 15th, 2025 (about 1 month ago)
|
|
CVE-2024-10098 |
ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access
Description: The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain
CVSS: LOW (2.7) EPSS Score: 0.04%
May 15th, 2025 (about 1 month ago)
|
|
CVE-2024-10076 |
Description: The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldn’t, ultimately making it possible for contributor and above users to perform Stored XSS attacks
CVSS: MEDIUM (5.9) EPSS Score: 0.03%
May 15th, 2025 (about 1 month ago)
|
|
CVE-2024-10075 |
Description: The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block.
EPSS Score: 0.05%
May 15th, 2025 (about 1 month ago)
|
|
CVE-2024-10054 |
Description: The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS: MEDIUM (4.8) EPSS Score: 0.03%
May 15th, 2025 (about 1 month ago)
|
|
CVE-2024-10009 |
Description: The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
EPSS Score: 0.03%
May 15th, 2025 (about 1 month ago)
|
|
CVE-2024-0970 |
Description: This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.
CVSS: HIGH (7.5) EPSS Score: 0.09%
May 15th, 2025 (about 1 month ago)
|
|
CVE-2024-0852 |
Description: The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated users to perform Stored XSS attack against high privilege users such as admin
CVSS: MEDIUM (6.1) EPSS Score: 0.13%
May 15th, 2025 (about 1 month ago)
|
|
CVE-2024-0249 |
Description: The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins.
CVSS: MEDIUM (6.1) EPSS Score: 0.09%
May 15th, 2025 (about 1 month ago)
|