WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product fields✕
Overview 27 matches · 0 in Waratek scope · 0 protected · 2 exploited · 0 CISA KEV · 5 public PoC · 0 EPSS ≥ 0.5
27matches 0in Waratek scope0.0% 0protected0.0% 2exploited7.4% 0CISA KEV0.0% 5public PoC18.5% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 27 100.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 27 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 27 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 7.4% Working exploit published 3 11.1% Proof of concept only 5 18.5% Forecast only 0 0.0% No public exploit 17 63.0%
split by peak 8 / year
Not applicable: 27 High: 27 not blocked: 27 No public exploit: 17Proof of concept only: 5Working exploit published: 3Exploited: 2
20101 Not applicable1 High1 not blocked1 Working exploit published1 20110 20120 20130 20142 Not applicable2 High2 not blocked2 Working exploit published2 20150 20160 20170 20180 20191 Not applicable1 High1 not blocked1 No public exploit1 20200 20211 Not applicable1 High1 not blocked1 No public exploit1 20223 Not applicable3 High3 not blocked3 Proof of concept only1 No public exploit2 20238 Not applicable8 High8 not blocked8 Exploited2 Proof of concept only2 No public exploit4 20248 Not applicable8 High8 not blocked8 Proof of concept only1 No public exploit7 20253 Not applicable3 High3 not blocked3 Proof of concept only1 No public exploit2
20112013201520172019202120232025
27 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-49291 High 2025-06-06 Not applicable No public exploit Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross Site Request Forgery.This issue affects Calculated Fields Form: from n/a through <= 5.3.58.
CVE-2024-13632 High 2025-02-26 Not applicable Proof of concept only The WP Extra Fields WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVE-2024-13311 High 2025-01-09 Not applicable No public exploit Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: *.*.
CVE-2024-10800 High 2024-11-13 Not applicable No public exploit The WordPress User Extra Fields plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the ajax_save_fields() function in all versions up to, and including, 16.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to add custom fields that can be updated and then use the check_and_overwrite_wp_or_woocommerce_fields function to update the wp_capabilities field to have administrator privileges.
CVE-2024-4565 High 2024-06-20 Not applicable Proof of concept only The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access
CVE-2024-32081 High 2024-06-09 Not applicable No public exploit Missing Authorization vulnerability in Websupporter Filter Custom Fields & Taxonomies Light.This issue affects Filter Custom Fields & Taxonomies Light: from n/a through 1.05.
CVE-2024-31267 High 2024-06-09 Not applicable No public exploit Missing Authorization vulnerability in WP Desk Flexible Checkout Fields for WooCommerce.This issue affects Flexible Checkout Fields for WooCommerce: from n/a through 4.1.2.
CVE-2024-29759 High 2024-03-27 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodePeople Calculated Fields Form allows Reflected XSS.This issue affects Calculated Fields Form: from n/a through 1.2.54.
CVE-2024-2020 High 2024-03-13 Not applicable No public exploit The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form page href parameter in all versions up to, and including, 5.1.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the professional version or higher.
CVE-2023-6996 High 2024-02-05 Not applicable No public exploit The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Code Injection via the plugin's vg_display_data shortcode in all versions up to, and including, 1.2.1 due to insufficient input validation and restriction on access to that shortcode. This makes it possible for authenticated attackers with contributor-level and above permissions to call arbitrary functions and execute code.
CVE-2022-40696 High 2024-01-08 Not applicable No public exploit Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2.
CVE-2023-22676 High 2023-12-29 Not applicable No public exploit Missing Authorization vulnerability in Anders Thorborg.This issue affects Anders Thorborg: from n/a through 1.4.12.
CVE-2023-45655 High 2023-10-16 Not applicable No public exploit Cross-Site Request Forgery (CSRF) vulnerability in PixelGrade PixFields plugin <= 0.7.0 versions.
CVE-2020-36731 High 2023-06-07 Not applicable Exploited The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via an admin_init hook, along with missing sanitization and escaping on the settings that are stored.
CVE-2020-36696 High 2023-06-07 Not applicable No public exploit The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_downloads() function in versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to download files from the vulnerable service.
CVE-2023-30777 High 2023-05-10 Not applicable Exploited Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.
CVE-2022-46864 High 2023-05-09 Not applicable No public exploit Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Umair Saleem Woocommerce Custom Checkout Fields Editor With Drag & Drop plugin <= 0.1 versions.
CVE-2023-1196 High 2023-05-02 Not applicable Proof of concept only The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.
CVE-2023-0277 High 2023-04-17 Not applicable Proof of concept only The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
CVE-2022-40839 High 2022-11-01 Not applicable Proof of concept only A SQL injection vulnerability in the height and width parameter in NdkAdvancedCustomizationFields v3.5.0 allows unauthenticated attackers to exfiltrate database data.
CVE-2022-2594 High 2022-08-22 Not applicable No public exploit The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.
CVE-2021-24865 High 2022-01-24 Not applicable No public exploit The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue
CVE-2021-20865 High 2021-12-13 Not applicable No public exploit Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.
CVE-2013-7476 High 2019-08-14 Not applicable No public exploit The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.
CVE-2013-6884 High 2014-01-07 Not applicable Working exploit published The write-blocker in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a has a default "ditto" username and password, which allows remote attackers to gain privileges.
CVE-2013-6881 High 2014-01-07 Not applicable Working exploit published CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) sector size or (2) skip count fields for the forensic imaging task.
CVE-2010-2036 High 2010-05-25 Not applicable Working exploit published Directory traversal vulnerability in the Percha Fields Attach (com_perchafieldsattach) component 1.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.