CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2025-24591	WordPress GDPR CCPA Compliance & Cookie Consent Banner plugin <= 2.7.1 - Broken Access Control vulnerability Description: Missing Authorization vulnerability in NinjaTeam GDPR CCPA Compliance Support allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GDPR CCPA Compliance Support: from n/a through 2.7.1. CVSS: MEDIUM (4.3) EPSS Score: 0.04% Source: CVE January 25th, 2025 (5 months ago)
CVE-2025-24589	WordPress JSM Show Post Metadata plugin <= 4.6.0 - Broken Access Control vulnerability Description: Missing Authorization vulnerability in JS Morisset JSM Show Post Metadata allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JSM Show Post Metadata: from n/a through 4.6.0. CVSS: MEDIUM (4.3) EPSS Score: 0.04% Source: CVE January 25th, 2025 (5 months ago)
CVE-2025-24588	WordPress Patreon WordPress plugin <= 1.9.1 - Broken Access Control vulnerability Description: Missing Authorization vulnerability in Patreon Patreon WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Patreon WordPress: from n/a through 1.9.1. CVSS: MEDIUM (6.5) EPSS Score: 0.04% Source: CVE January 25th, 2025 (5 months ago)
CVE-2025-24587	WordPress Email Subscription Popup plugin <= 1.2.23 - SQL Injection vulnerability Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in I Thirteen Web Solution Email Subscription Popup allows Blind SQL Injection. This issue affects Email Subscription Popup: from n/a through 1.2.23. CVSS: HIGH (7.6) EPSS Score: 0.04% Source: CVE January 25th, 2025 (5 months ago)
CVE-2025-24585	WordPress Event post plugin <= 5.9.7 - Stored Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N.O.U.S. Open Useful and Simple Event post allows Stored XSS. This issue affects Event post: from n/a through 5.9.7. CVSS: MEDIUM (6.5) EPSS Score: 0.04% Source: CVE January 25th, 2025 (5 months ago)
CVE-2025-24582	WordPress 12 Step Meeting List plugin <= 3.16.5 - Sensitive Data Exposure vulnerability Description: Insertion of Sensitive Information Into Sent Data vulnerability in Code for Recovery 12 Step Meeting List allows Retrieve Embedded Sensitive Data. This issue affects 12 Step Meeting List: from n/a through 3.16.5. CVSS: MEDIUM (5.3) EPSS Score: 0.04% Source: CVE January 25th, 2025 (5 months ago)
CVE-2025-24580	WordPress 12 Step Meeting List plugin <= 3.16.5 - Arbitrary Content Deletion vulnerability Description: Missing Authorization vulnerability in Code for Recovery 12 Step Meeting List allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects 12 Step Meeting List: from n/a through 3.16.5. CVSS: MEDIUM (6.5) EPSS Score: 0.04% Source: CVE January 25th, 2025 (5 months ago)
CVE-2025-24579	WordPress Nested pages plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Nested Pages allows Stored XSS. This issue affects Nested Pages: from n/a through 3.2.9. CVSS: MEDIUM (5.9) EPSS Score: 0.04% Source: CVE January 25th, 2025 (5 months ago)
CVE-2025-24578	WordPress ElementInvader Addons for Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ElementInvader ElementInvader Addons for Elementor allows DOM-Based XSS. This issue affects ElementInvader Addons for Elementor: from n/a through 1.3.0. CVSS: MEDIUM (6.5) EPSS Score: 0.04% Source: CVE January 25th, 2025 (5 months ago)
CVE-2025-24575	WordPress HelloAsso plugin <= 1.1.11 - Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso HelloAsso allows Stored XSS. This issue affects HelloAsso: from n/a through 1.1.11. CVSS: MEDIUM (6.5) EPSS Score: 0.04% Source: CVE January 25th, 2025 (5 months ago)