newsThe portal itself — self-promo until real sponsors land
Subscribe, build a custom feed, or pitch a sponsorship at hello@acadenix.com
Latest intel// live feed
25 results//sorted by published//last sync 2026-07-14 18:54Z
Subscribe to news →
CVE-2023-2237 — Yudiz Wp_replicate_post: The WP Replicate Post plugin for WordPress is vulnerable to SQL Injection via the
The WP Replicate Post plugin for WordPress is vulnerable to SQL Injection via the post_id parameter in versions up to, and including, 4.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for contributor-level attackers or higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVSSv3.1 8.8 (HIGH) · EPSS 52th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2023-1895 — Motopress Getwid: The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpoint in versions up to, and including, 1.8.3. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. CVSSv3.1 8.5 (HIGH) · EPSS 42th percentile
8.5
CVSS v3.1
93
Edit Score
CVE-2023-1888 — Wpwax Directorist: The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in
The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4. This is due to a lack of validation checks within login.php. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to reset the password of an arbitrary user and gain elevated (e.g., administrator) privileges. CVSSv3.1 8.8 (HIGH) · EPSS 60th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2023-0992 — Getshieldsecurity Shield_security: The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions
The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and including, 17.0.17 via the 'User-Agent' header. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVSSv3.1 7.2 (HIGH) · EPSS 97th percentile
7.2
CVSS v3.1
98
Edit Score
CVE-2023-0721 — Wpmet Metform_elementor_contact_form_builder: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration. CVSSv3.1 8.3 (HIGH) · EPSS 75th percentile
8.3
CVSS v3.1
92
Edit Score
CVE-2023-2986 — Tychesoftwares Abandoned_cart_lite_for_woocommerce: The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulner CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2021-4380 — Valvepress Pinterest_automatic_pin: The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing
The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_request' function and the 'process_form.php' script in versions up to, and including, 1.14.3. This makes it possible for unauthenticated attackers to update arbitrary options on a site that can be used to create new administrative user accounts or redirect unsuspecting site visitors. CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2021-4337 — Xforwoocommerce Add_product_tabs: Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a
Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2 CVSSv3.1 8.8 (HIGH) · EPSS 41th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2020-36728 — Tunasite Adning_advertising: The Adning Advertising plugin for WordPress is vulnerable to file deletion via path traversal
The Adning Advertising plugin for WordPress is vulnerable to file deletion via path traversal in versions up to, and including, 1.5.5. This allows unauthenticated attackers to delete arbitrary files which can be used to reset and gain full control of a site. CVSSv3.1 6.5 (MEDIUM) · EPSS 99th percentile
6.5
CVSS v3.1
100
Edit Score
CVE-2020-36705 — Tunasite Adning_advertising: The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to
The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_image function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2023-3124 — Elementor Elementor_pro: The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to
The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to, and including, 3.11.6. This makes it possible for authenticated attackers with subscriber-level capabilities to update arbitrary site options, which can lead to privilege escalation. CVSSv3.1 8.8 (HIGH) · EPSS 96th percentile
8.8
CVSS v3.1
100
Edit Score
CVE-2022-4950 — Coolplugins Cool_timeline: Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and
Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permissions, such as a subscriber. CVSSv3.1 8.8 (HIGH) · EPSS 90th percentile
8.8
CVSS v3.1
96
Edit Score
CVE-2022-4949 — Adsanityplugin Adsanity: The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing
The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_upload' function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers with Contributor+ level privileges to upload arbitrary files on the affected sites server which makes remote code execution possible. CVSSv3.1 8.8 (HIGH) · EPSS 93th percentile
8.8
CVSS v3.1
97
Edit Score
CVE-2021-4383 — Webdevocean Wp_quick_frontend_editor: The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection
The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due to missing capability checks in the plugin's page-editing functionality. This makes it possible for low-authenticated attackers, such as subscribers, to edit/create any page or post on the blog. CVSSv3.1 8.1 (HIGH) · EPSS 37th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2021-4382 — Recently_project Recently: The Recently plugin for WordPress is vulnerable to arbitrary file uploads due to missing
The Recently plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the fetch_external_image() function in versions up to, and including, 3.0.4. This makes it possible for authenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 8.8 (HIGH) · EPSS 93th percentile
8.8
CVSS v3.1
97
Edit Score
CVE-2021-4381 — Stylemixthemes Ulisting: The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to
The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing security nonce, in the StmListingSingleLayout::import_new_layout method in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to change any WordPress option in the database. CVSSv3.1 9.8 (CRITICAL) · EPSS 62th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2021-4374 — Valvepress Wordpress_automatic_plugin: The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions
The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option validation in the process_form.php file. This makes it possible for unauthenticated attackers to arbitrarily update the settings of a vulnerable site and ultimately compromise the entire site. CVSSv3.1 9.1 (CRITICAL) · EPSS 99th percentile
9.1
CVSS v3.1
100
Edit Score
CVE-2021-4373 — Webberzone Better_search: The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions
The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to import settings via forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 33th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2021-4370 — Stylemixthemes Ulisting: The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and
The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is seldom validated. This issue exists in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to conduct numerous administrative actions, including those less critical than the explicitly outlined ones in our detection. CVSSv3.1 9.8 (CRITICAL) · EPSS 62th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2021-4368 — Najeebmedia Frontend_file_manager_plugin: The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in
The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2. This is due to lacking capability checks and a security nonce, all on the wpfm_save_settings AJAX action. This makes it possible for subscriber-level attackers to edit the plugin settings, such as the allowed upload file types. This can lead to remote code execution through other vulnerabilities. CVSSv3.1 9.9 (CRITICAL) · EPSS 92th percentile
9.9
CVSS v3.1
100
Edit Score
CVE-2021-4361 — Eyecix Jobsearch_wp_job_board: The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job_integrations_settin_save AJAX action in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to update arbitrary options on the site. CVSSv3.1 8.8 (HIGH) · EPSS 50th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2021-4360 — Wpruby Controlled_admin_access: The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions
The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This makes it possible for attackers to create a new administrator role with unrestricted access. CVSSv3.1 9.9 (CRITICAL) · EPSS 32th percentile
9.9
CVSS v3.1
100
Edit Score
CVE-2021-4357 — Stylemixthemes Ulisting: The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability
The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on the UlistingUserRole::save_role_api function in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to arbitrarily delete site posts and pages. CVSSv3.1 9.1 (CRITICAL) · EPSS 29th percentile
9.1
CVSS v3.1
96
Edit Score
CVE-2021-4356 — Najeebmedia Frontend_file_manager_plugin: The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, 18.2. This is due to lacking authentication protections, capability checks, and sanitization, all on the wpfm_file_meta_update AJAX action. This makes it possible for unauthenticated attackers to download arbitrary files on the site, potentially leading to site takeover. CVSSv3.1 9.0 (CRITICAL) · EPSS 73th percentile
9.0
CVSS v3.1
95
Edit Score
CVE-2021-4354 — Magazine3 Pwa_for_wp_\&_amp: The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads
The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwp_splashscreen_uploader function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. CVSSv3.1 8.8 (HIGH) · EPSS 92th percentile
8.8
CVSS v3.1
96
Edit Score