CyberAlerts

CVE-2024-13878

Description: The SpotBot WordPress plugin through 0.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

EPSS Score: 0.04%

Source: CVE

March 20th, 2025 (3 months ago)

CVE-2024-13877

Passbeemedia Web Push Notifications <= 1.0.0 - Reflected XSS

Description: The Passbeemedia Web Push Notification WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

EPSS Score: 0.04%

Source: CVE

March 20th, 2025 (3 months ago)

CVE-2024-13876

Meintopf <= 0.2.1 - Reflected XSS

Description: The mEintopf WordPress plugin through 0.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

EPSS Score: 0.04%

Source: CVE

March 20th, 2025 (3 months ago)

CVE-2024-13875

WP Programmmanager <= 1.2 - Reflected XSS

Description: The WP-PManager WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

EPSS Score: 0.04%

Source: CVE

March 20th, 2025 (3 months ago)

CVE-2025-1770

Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion

Description: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

CVSS: HIGH (8.8)

EPSS Score: 0.26%

Source: CVE

March 20th, 2025 (3 months ago)

CVE-2025-1766

Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update

Description: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'payment_complete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated attackers to update the status of ticket payments to 'completed', possibly resulting in financial loss.

CVSS: MEDIUM (5.3)

EPSS Score: 0.06%

Source: CVE

March 20th, 2025 (3 months ago)

CVE-2025-1314

Custom Twitter Feeds <= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function

Description: The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5. This is due to missing or incorrect nonce validation on the ctf_clear_cache_admin() function. This makes it possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS: MEDIUM (4.3)

EPSS Score: 0.02%

Source: CVE

March 20th, 2025 (3 months ago)

Malware campaign 'DollyWay' breached 20,000 WordPress sites

Description: A malware operation dubbed 'DollyWay' has been underway since 2016, compromising over 20,000 WordPress sites globally to redirect users to malicious sites. [...]

Source: BleepingComputer

March 19th, 2025 (3 months ago)

CVE-2024-1231

CM Download and File Manager < 2.9.0 - Download Unpublish via CSRF

Description: The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack

CVSS: MEDIUM (6.8)

EPSS Score: 0.01%

SSVC Exploitation: poc

Source: CVE

March 19th, 2025 (3 months ago)

CVE-2024-6244

pz-frontend-manager < 1.0.6 - CSRF change user profile picture

Description: The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

EPSS Score: 2.79%

SSVC Exploitation: poc

Source: CVE

March 19th, 2025 (3 months ago)

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2024-13878	SpotBot <= 0.1.8 - Reflected XSS Description: The SpotBot WordPress plugin through 0.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. EPSS Score: 0.04% Source: CVE March 20th, 2025 (3 months ago)
CVE-2024-13877	Passbeemedia Web Push Notifications <= 1.0.0 - Reflected XSS Description: The Passbeemedia Web Push Notification WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. EPSS Score: 0.04% Source: CVE March 20th, 2025 (3 months ago)
CVE-2024-13876	Meintopf <= 0.2.1 - Reflected XSS Description: The mEintopf WordPress plugin through 0.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. EPSS Score: 0.04% Source: CVE March 20th, 2025 (3 months ago)
CVE-2024-13875	WP Programmmanager <= 1.2 - Reflected XSS Description: The WP-PManager WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. EPSS Score: 0.04% Source: CVE March 20th, 2025 (3 months ago)
CVE-2025-1770	Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion Description: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. CVSS: HIGH (8.8) EPSS Score: 0.26% Source: CVE March 20th, 2025 (3 months ago)
CVE-2025-1766	Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update Description: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'payment_complete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated attackers to update the status of ticket payments to 'completed', possibly resulting in financial loss. CVSS: MEDIUM (5.3) EPSS Score: 0.06% Source: CVE March 20th, 2025 (3 months ago)
CVE-2025-1314	Custom Twitter Feeds <= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function Description: The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5. This is due to missing or incorrect nonce validation on the ctf_clear_cache_admin() function. This makes it possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSS: MEDIUM (4.3) EPSS Score: 0.02% Source: CVE March 20th, 2025 (3 months ago)
	Malware campaign 'DollyWay' breached 20,000 WordPress sites Description: A malware operation dubbed 'DollyWay' has been underway since 2016, compromising over 20,000 WordPress sites globally to redirect users to malicious sites. [...] Source: BleepingComputer March 19th, 2025 (3 months ago)
CVE-2024-1231	CM Download and File Manager < 2.9.0 - Download Unpublish via CSRF Description: The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack CVSS: MEDIUM (6.8) EPSS Score: 0.01% SSVC Exploitation: poc Source: CVE March 19th, 2025 (3 months ago)
CVE-2024-6244	pz-frontend-manager < 1.0.6 - CSRF change user profile picture Description: The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks EPSS Score: 2.79% SSVC Exploitation: poc Source: CVE March 19th, 2025 (3 months ago)