Threat database

5 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
Medium	5.3	EPSS 0.3%	CVE-2026-100508Two Factor · Allocation of Resources Without Limits or Throttling Medium5.3EPSS 0.3%2026-09-30CVE Database V5CVE-2026-100508 Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions. EPSS 0.3%Vulnerability WordPress.org #cwe-770	CVE Database V5	2026-09-30
Medium	–		https://downloads.wordpress.org/plugin/keepinmind-dashboard-notes.0.8.4.3.zip · KeepInMind 0.8.4.2 - Stored XSS Medium2026-07-06Exploit-DB RSS Feed KeepInMind 0.8.4.2 - Stored XSS Exploit https://wordpress.org/plugins/keepinmind-dashboard-notes #web #xss #exploit	Exploit-DB RSS Feed	2026-07-06
Medium	–		https://downloads.wordpress.org/plugin/temporary-login.1.0.0.zip · Wordpress Temporary Login Plugin 1.0.0 - 'temp-login-token' Authentication Bypass to Account Takeover Medium2026-05-26Exploit-DB RSS Feed The Wordpress Temporary Login Plugin version 1.0.0 contains an authentication bypass vulnerability via the 'temp-login-token' parameter that can lead to account takeover. This vulnerability affects version 1.0.0 and earlier. No official patch or remediation information is provided. The severity is assessed as medium based on the potential for unauthorized account access. Vulnerability https://wordpress.org #web #exploit #linux	Exploit-DB RSS Feed	2026-05-26
Medium	4.9	EPSS 0.5%	CVE-2025-64253Health Check & Troubleshooting · Path Traversal: '.../...//' Medium4.9EPSS 0.5%2025-12-16CVE Database V5CVE-2025-64253 Path Traversal: '.../...//' vulnerability in WordPress.org Health Check & Troubleshooting health-check allows Path Traversal.This issue affects Health Check & Troubleshooting: from n/a through <= 1.7.1. EPSS 0.5%Vulnerability WordPress.org	CVE Database V5	2025-12-16
Medium	5.4	EPSS 0.2%	CVE-2025-4583Smash Balloon Instagram Feed Pro · Cross-site Scripting Medium5.4EPSS 0.2%2025-05-29CVE Database V5CVE-2025-4583 The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-plugin` attribute in all versions up to, and including, 6.9.0 (Free) and 6.8.0 (Pro) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. EPSS 0.2%Vulnerability https://profiles.wordpress.org/smub/#cwe-79	CVE Database V5	2025-05-29

Showing 1–5 of 5 results