CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2024-8031	Secure Downloads < 1.2.3 - Admin+ Arbitrary File Download Description: The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php. EPSS Score: 0.04% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-8009	Sensei LMS < 4.20.0 - Teacher+ Users Email Address Disclosure Description: The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page CVSS: HIGH (7.5) EPSS Score: 0.05% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-7984	Joy Of Text Lite – SMS messaging for WordPress <= 2.3.1 - Settings Update via CSRF Description: The Joy Of Text Lite WordPress plugin through 2.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack CVSS: MEDIUM (4.3) EPSS Score: 0.02% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-7769	Wordpress Clicksold IDX Plugin <= 1.90 - Admin+ XSS Description: The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). CVSS: MEDIUM (4.8) EPSS Score: 0.0% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-7762	Simple Job Board < 2.12.6 - Unauthenticated Resumes Download Description: The Simple Job Board WordPress plugin before 2.12.6 does not prevent uploaded files from being listed, allowing unauthenticated users to access and download uploaded resumes CVSS: HIGH (7.5) EPSS Score: 0.04% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-7761	Simple Job Board < 2.12.2 - Admin+ Stored XSS Description: In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor CVSS: MEDIUM (6.1) EPSS Score: 0.0% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-7759	PWA For WP & AMP < 1.7.72 Administrator+ Stored XSS Description: The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). CVSS: MEDIUM (4.8) EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-7758	Stylish Price List < 7.1.8 - Contributor+ Stored XSS Description: The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). EPSS Score: 0.03% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-7556	Wordpress Simple Share Plugin <=0.5.3 - Admin+ XSS Description: The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). CVSS: MEDIUM (4.8) EPSS Score: 0.02% Source: CVE May 15th, 2025 (about 1 month ago)
CVE-2024-6809	Simple Video Directory < 1.4.3 - Unauthenticated SQLi Description: The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. CVSS: CRITICAL (9.8) EPSS Score: 0.15% Source: CVE May 15th, 2025 (about 1 month ago)