Threat database

8 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
Medium	6.4	EPSS 0.2%	CVE-2026-93535Dark Mode – Improve Accessibility with AI Powered Dark Theme · Cross-site Scripting Medium6.4EPSS 0.2%2026-10-16CVE Database V5CVE-2026-93535 The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. EPSS 0.2%Vulnerability wppool #cwe-79	CVE Database V5	2026-10-16
High	7.5	EPSS 0.4%	CVE-2026-28571FormyChat · Missing Authorization High7.5EPSS 0.4%2026-08-18CVE Database V5CVE-2026-28571 Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions. EPSS 0.4%Vulnerability WPPOOL #cwe-862	CVE Database V5	2026-08-18
High	7.1	EPSS 0.3%	CVE-2026-57379FormyChat · Cross-site Scripting High7.1EPSS 0.3%2026-07-13CVE Database V5CVE-2026-57379 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL FormyChat social-contact-form allows Stored XSS.This issue affects FormyChat: from n/a through <= 2.15.3. EPSS 0.3%Vulnerability WPPOOL #cwe-79	CVE Database V5	2026-07-13
Medium	4.3	EPSS 0.2%	CVE-2026-24582FlexTable · Missing Authorization Medium4.3EPSS 0.2%2026-05-25CVE Database V5CVE-2026-24582 Missing Authorization vulnerability in WPPOOL FlexTable allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FlexTable: from n/a through 3.24.0. EPSS 0.2%Vulnerability WPPOOL #cwe-862	CVE Database V5	2026-05-25
High	7.6	EPSS 0.6%	CVE-2025-30765FlexStock · SQL Injection High7.6EPSS 0.6%2025-03-27CVE Database V5CVE-2025-30765 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPPOOL FlexStock stock-sync-with-google-sheet-for-woocommerce allows Blind SQL Injection.This issue affects FlexStock: from n/a through <= 3.13.1. EPSS 0.6%Vulnerability WPPOOL	CVE Database V5	2025-03-27
Medium	4.3	EPSS 0.3%	CVE-2024-5449WP Dark Mode – Improve Accessibility with AI Powered Dark Theme · Missing Authorization Medium4.3EPSS 0.3%2024-06-06CVE Database V5CVE-2024-5449 The WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdm_social_share_save_options function in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings. EPSS 0.3%Vulnerability wppool #cwe-862	CVE Database V5	2024-06-06
Medium	5.9	EPSS 0.4%	CVE-2024-34375Sheets To WP Table Live Sync · Cross-site Scripting Medium5.9EPSS 0.4%2024-05-06CVE Database V5CVE-2024-34375 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Sheets To WP Table Live Sync allows Stored XSS.This issue affects Sheets To WP Table Live Sync: from n/a through 3.7.0. EPSS 0.4%Vulnerability WPPOOL #cwe-79	CVE Database V5	2024-05-06
Medium	6.5	EPSS 0.4%	CVE-2024-30437Webinar and Video Conference with Jitsi Meet · Cross-site Scripting Medium6.5EPSS 0.4%2024-03-29CVE Database V5CVE-2024-30437 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Webinar and Video Conference with Jitsi Meet allows Stored XSS.This issue affects Webinar and Video Conference with Jitsi Meet: from n/a through 2.6.3. EPSS 0.4%Vulnerability WPPOOL #cwe-79	CVE Database V5	2024-03-29

Showing 1–8 of 8 results