Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,471

CVE-2024-7713

AI Chatbot with ChatGPT by AYS <= 2.0.9 - Unauthenticated OpenAI Key Disclosure

The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 discloses the Open AI API Key, allowing unauthenticated users to obtain it

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ays-pro
Products
Ai Chatbot With Chatgpt Chatgpt Assistant
CVE-2024-8700

Event Calendar <= 1.0.4 - Unauthenticated Arbitrary Calendar Deletion

The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Total-soft
Products
Event Calendar
CVE-2024-13925

Klarna Checkout for WooCommerce < 2.13.5 - DoS via Excessive Logging

The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per request. This can result in rapid consumption of disk space, potentially filling the entire disk.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Klarna
Products
Klarna Checkout For Woocommerce
CVE-2024-5333

The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure

The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Stellarwp
Products
The Events Calendar
CVE-2024-6289

WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure

The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wpserveur
Products
Wps Hide Login
CVE-2024-6477

UsersWP < 1.2.12 - Users Information Disclosure

The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ayecode
Products
Userswp
CVE-2024-6420

Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure

The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.

CVSS 3.1 · 8.6 High EPSS 1.8% KEV · Not listed
Vendors
Wpplugins
Products
Hide My Wp Ghost
CVE-2024-7315

Migration, Backup, Staging – WPvivid < 0.9.106 - Unauthenticated Sensitive Data Exposure

The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when generating a backup, which could be bruteforced by attackers to leak sensitive information about said backups.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wpvivid Wpvivid Team
Products
Migration\, Backup\, Staging Migration Backup Staging
CVE-2024-7786

Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak

The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Automattic
Products
Sensei Lms
CVE-2024-13688

Admin and Site Enhancements (ASE) < 7.6.10 - Password Protection Bypass

The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded password in its Password Protection feature, allowing attacker to bypass the protection offered via a crafted request

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpase
Products
Admin And Site Enhancements
CVE-2024-4565

Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access

The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Advancedcustomfields Wpengine
Products
Advanced Custom Fields Advanced Custom Field Pro Advanced Custom Fields
CVE-2024-1287

Paid Memberships Pro - Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi

The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes via an SQLi vector.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Paidmembershipspro Strangerstudios
Products
Paid Memberships Pro Paid Memberships Pro
CVE-2024-7714

AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls

The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 from OpenAI, thereby disabling the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0. Multiple actions are accessible: 'ays_chatgpt_disconnect', 'ays_chatgpt_connect', and 'ays_chatgpt_save_feedback'

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ays-pro
Products
Ai Chatbot With Chatgpt Chatgpt Assistant
CVE-2025-4094

Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.

CVSS 3.1 · 9.8 Critical EPSS 16.6% KEV · Not listed
Vendors
Unitedover
Products
Digits
CVE-2024-5973

MasterStudy LMS < 3.3.24 - Privilege Escalation to Instructor

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.3.24 does not prevent students from creating instructor accounts, which could be used to get access to functionalities they shouldn't have.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Stylemixthemes
Products
Masterstudy Lms
CVE-2024-5570

Simple Photoswipe <= 0.1 - Subscriber+ Arbitrary Settings Update

The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Tobias Cichon Zitscher
Products
Simple Photoswipe Simple Photoswipe
CVE-2024-12812

WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employees.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Wp Erp
CVE-2024-11638

Gtbabel < 6.6.9 - Unauthenticated Admin Account Takeover

The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow unauthenticated attackers to retrieve a logged in user (such as admin) cookies by making them open a crafted URL as the request made to analysed the URL contains such cookies.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Gtbabel
Products
Gtbabel
CVE-2024-12274

BookingPress < 1.1.23 - Unauthenticated Export File Download

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings functionality exports data to a public folder, with an easily guessable file name, allowing unauthenticated attackers to access the exported files (if they exist).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Codepeople
Products
Appointment Booking Calendar