CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2025-22628	WordPress Filled In Plugin <= 1.9.2 - CSRF to Stored XSS vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foliovision Filled In allows Stored XSS.This issue affects Filled In: from n/a through 1.9.2. CVSS: HIGH (7.1) EPSS Score: 0.04% Source: CVE March 27th, 2025 (3 months ago)
CVE-2025-22497	WordPress Simple Google Calendar Outlook Events Block Widget plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A.H.C. Waasdorp Simple Google Calendar Outlook Events Block Widget allows Stored XSS.This issue affects Simple Google Calendar Outlook Events Block Widget: from n/a through 2.5.0. CVSS: MEDIUM (6.5) EPSS Score: 0.03% Source: CVE March 27th, 2025 (3 months ago)
CVE-2025-22496	WordPress Notif Bell Plugin <= 0.9.8 - Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MarMar8x Notif Bell allows Stored XSS.This issue affects Notif Bell: from n/a through 0.9.8. CVSS: MEDIUM (5.9) EPSS Score: 0.03% Source: CVE March 27th, 2025 (3 months ago)
CVE-2025-22278	WordPress Whitish Lite theme <= 2.1.13 - Stored Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yudleethemes Whitish Lite allows Stored XSS.This issue affects Whitish Lite: from n/a through 2.1.13. CVSS: MEDIUM (6.5) EPSS Score: 0.03% SSVC Exploitation: none Source: CVE March 27th, 2025 (3 months ago)
CVE-2024-5627	WordPress Plugin Tournamatch < 4.6.1 - Subscriber+ Stored XSS Description: The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some parameters, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks. EPSS Score: 0.06% SSVC Exploitation: poc Source: CVE March 27th, 2025 (3 months ago)
CVE-2024-4856	FS Product Inquiry <= 1.1.1 - Reflected XSS Description: The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users EPSS Score: 0.18% SSVC Exploitation: none Source: CVE March 27th, 2025 (3 months ago)
CVE-2024-37474	WordPress Newspack Ads plugin <= 1.47.1 - Cross Site Scripting (XSS) vulnerability Description: Cross Site Scripting (XSS) vulnerability in Automattic Newspack Ads allows Stored XSS.This issue affects Newspack Ads: from n/a through 1.47.1. CVSS: MEDIUM (6.5) EPSS Score: 0.06% SSVC Exploitation: none Source: CVE March 27th, 2025 (3 months ago)
CVE-2024-37472	WordPress Woffice theme <= 5.4.8 - Reflected Cross Site Scripting (XSS) vulnerability Description: Cross Site Scripting (XSS) vulnerability in WofficeIO Woffice allows Reflected XSS.This issue affects Woffice: from n/a through 5.4.8. CVSS: HIGH (7.1) EPSS Score: 0.08% SSVC Exploitation: none Source: CVE March 27th, 2025 (3 months ago)
CVE-2024-3642	Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF Description: The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack EPSS Score: 0.09% SSVC Exploitation: none Source: CVE March 27th, 2025 (3 months ago)
CVE-2024-1588	SendPress Newsletters <= 1.23.11.6 - Admin+ Stored XSS via Settings Description: The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) EPSS Score: 0.29% SSVC Exploitation: none Source: CVE March 27th, 2025 (3 months ago)