Search
Find a vulnerability
Search criteria
42 vulnerabilities by davidanderson
CVE-2026-90992 (GCVE-0-2026-90992)
Vulnerability from nvd – Published: 2026-10-01 08:28 – Updated: 2026-10-01 18:25
VLAI
EPSS
VEX
Title
Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field
Summary
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users who can store a payload in user meta fields such as the biography, session_tokens (via a crafted User-Agent at login), or persisted_preferences (via the REST API), which are then promoted to the site-wide redux_demo option when a media URL repair is triggered on the demo panel.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 18:24 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | Redux Framework |
Affected:
0 , ≤ 4.5.14
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90992",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T18:24:23.758653Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T18:25:50.057Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Redux Framework",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "daroo"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via \u0027user-mediaurl\u0027 Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users who can store a payload in user meta fields such as the biography, session_tokens (via a crafted User-Agent at login), or persisted_preferences (via the REST API), which are then promoted to the site-wide redux_demo option when a media URL repair is triggered on the demo panel."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T08:28:41.178Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2274a464-4eeb-4c8a-b138-44fef6b4a3a5?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/assets/js/vendor/jsonview.js#L136"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/users/class-redux-extension-users.php#L365"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/users/class-redux-users-api.php#L558"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/classes/class-redux-options-constructor.php#L632"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/classes/class-redux-options-constructor.php#L189"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3705066%40redux-framework%2Ftags%2F4.5.15\u0026old=3688279%40redux-framework%2Ftags%2F4.5.14"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3705066/redux-framework/trunk/redux-core/assets/js/vendor/jsonview.js"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-14T15:22:31.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-30T20:01:14.000Z",
"value": "Disclosed"
}
],
"title": "Redux Framework \u003c= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027user-mediaurl\u0027 Media Field"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-90992",
"datePublished": "2026-10-01T08:28:41.178Z",
"dateReserved": "2026-09-14T14:30:20.066Z",
"dateUpdated": "2026-10-01T18:25:50.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88999 (GCVE-0-2026-88999)
Vulnerability from nvd – Published: 2026-10-01 05:30 – Updated: 2026-10-03 15:42
VLAI
EPSS
VEX
Title
Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter
Summary
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media library attachments, including administrator-owned files, from the affected site. This is exploitable by Subscribers when a Custom Fonts field is registered on the user profile page via Redux_Users::set_profile(), as doing so causes the required redux_custom_fonts nonce to be rendered into the Subscriber's wp-admin/profile.php page.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:29 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
13 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | Redux Framework |
Affected:
0 , ≤ 4.5.14
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88999",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:29:33.178456Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:42:52.610Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Redux Framework",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eunho Kim"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media library attachments, including administrator-owned files, from the affected site. This is exploitable by Subscribers when a Custom Fonts field is registered on the user profile page via Redux_Users::set_profile(), as doing so causes the required redux_custom_fonts nonce to be rendered into the Subscriber\u0027s wp-admin/profile.php page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T05:30:55.556Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c7e24790-01a0-41bc-a380-60d86c6e1443?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.13/redux-core/inc/extensions/custom_fonts/custom_fonts/class-redux-custom-fonts.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.13/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L338"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.13/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L392"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.13/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L617"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L571"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L617"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L338"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L392"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/custom_fonts/custom_fonts/class-redux-custom-fonts.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.13/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L571"
},
{
"url": "https://github.com/reduxframework/redux-framework/pull/4117/changes"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3705066/redux-framework/trunk/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-10T16:30:36.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-30T16:41:29.000Z",
"value": "Disclosed"
}
],
"title": "Redux Framework \u003c= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via \u0027attachment_id\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-88999",
"datePublished": "2026-10-01T05:30:55.556Z",
"dateReserved": "2026-09-10T16:15:30.715Z",
"dateUpdated": "2026-10-03T15:42:52.610Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5410 (GCVE-0-2026-5410)
Vulnerability from nvd – Published: 2026-09-19 08:27 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input
Summary
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the user_meta_save() function scalar values bypass the sanitization logic that only processes arrays, allowing the spinner field value to be stored in user meta without proper sanitization. Later, at line 56 of class-redux-spinner.php in the render() function, this value is rendered in an unquoted HTML attribute without escaping via '$data_string .= ' data-val=' . $this->value;'. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:17 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | Redux Framework |
Affected:
0 , ≤ 4.5.13
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5410",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:17:57.767016Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:20.094Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Redux Framework",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Luc Huynh from Noventiq RedTeam"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the user_meta_save() function scalar values bypass the sanitization logic that only processes arrays, allowing the spinner field value to be stored in user meta without proper sanitization. Later, at line 56 of class-redux-spinner.php in the render() function, this value is rendered in an unquoted HTML attribute without escaping via \u0027$data_string .= \u0027 data-val=\u0027 . $this-\u003evalue;\u0027. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T08:27:20.952Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/116c57c2-6257-40b3-a838-194f8959be16?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/fields/spinner/class-redux-spinner.php#L56"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/fields/spinner/class-redux-spinner.php#L56"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/extensions/users/class-redux-extension-users.php#L1018"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/extensions/users/class-redux-extension-users.php#L1018"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3688279%40redux-framework%2Ftags%2F4.5.14\u0026old=3582185%40redux-framework%2Ftags%2F4.5.13"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3688279/redux-framework/trunk/redux-core/inc/extensions/users/class-redux-extension-users.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-02T07:19:19.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-18T19:55:15.000Z",
"value": "Disclosed"
}
],
"title": "Redux Framework \u003c= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-5410",
"datePublished": "2026-09-19T08:27:20.952Z",
"dateReserved": "2026-04-02T07:04:02.995Z",
"dateUpdated": "2026-09-19T13:51:20.094Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5400 (GCVE-0-2026-5400)
Vulnerability from nvd – Published: 2026-09-19 07:43 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input
Summary
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13 This is due to insufficient input sanitization of nested array values in the user_meta_save() function and unsafe output of filter CSS values in the render() function without proper escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:25 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | Redux Framework |
Affected:
0 , ≤ 4.5.13
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5400",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:25:56.982054Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:20.891Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Redux Framework",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "h0xilo"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13 This is due to insufficient input sanitization of nested array values in the user_meta_save() function and unsafe output of filter CSS values in the render() function without proper escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:19.874Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca5b1ff6-19c5-4384-ae63-faf1f40122e7?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/fields/media/class-redux-media.php#L233"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/fields/media/class-redux-media.php#L233"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/fields/media/class-redux-media.php#L337"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/fields/media/class-redux-media.php#L337"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/extensions/users/class-redux-extension-users.php#L1034"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/extensions/users/class-redux-extension-users.php#L1034"
},
{
"url": "https://github.com/reduxframework/redux-framework/pull/4112/changes"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3688279%40redux-framework%2Ftags%2F4.5.14\u0026old=3582185%40redux-framework%2Ftags%2F4.5.13"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3688279/redux-framework/trunk/redux-core/inc/fields/media/class-redux-media.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-02T06:50:46.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-18T19:01:22.000Z",
"value": "Disclosed"
}
],
"title": "Redux Framework \u003c= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-5400",
"datePublished": "2026-09-19T07:43:19.874Z",
"dateReserved": "2026-04-02T06:29:52.259Z",
"dateUpdated": "2026-09-19T13:51:20.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5399 (GCVE-0-2026-5399)
Vulnerability from nvd – Published: 2026-09-10 09:27 – Updated: 2026-09-10 12:55
VLAI
EPSS
VEX
Title
Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value
Summary
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user_meta_save() function (which only sanitizes array values, not scalar values) and improper output escaping in the Redux_Slider::render() method, which outputs slider values into unquoted HTML attributes. The vulnerability also exploits the fact that the clean_default() method only casts values to numeric types when they are empty or out of bounds, allowing malicious strings like '1 tabindex=0 autofocus onfocus=alert(1) x=' to pass validation through PHP's loose type comparison. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into their user profile that will execute whenever an Administrator navigates to view the attacker's profile page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 12:55 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | Redux Framework |
Affected:
0 , ≤ 4.5.13.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5399",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T12:55:47.555159Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T12:55:57.736Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Redux Framework",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.13.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "h0xilo"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user_meta_save() function (which only sanitizes array values, not scalar values) and improper output escaping in the Redux_Slider::render() method, which outputs slider values into unquoted HTML attributes. The vulnerability also exploits the fact that the clean_default() method only casts values to numeric types when they are empty or out of bounds, allowing malicious strings like \u00271 tabindex=0 autofocus onfocus=alert(1) x=\u0027 to pass validation through PHP\u0027s loose type comparison. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into their user profile that will execute whenever an Administrator navigates to view the attacker\u0027s profile page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T09:27:08.744Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/31c554cf-eee9-45a8-8fb6-198978620204?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/fields/slider/class-redux-slider.php#L311"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/fields/slider/class-redux-slider.php#L311"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/extensions/users/class-redux-extension-users.php#L1018"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/extensions/users/class-redux-extension-users.php#L1018"
},
{
"url": "https://github.com/reduxframework/redux-framework/pull/4112/changes"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-02T06:49:25.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-09T21:20:33.000Z",
"value": "Disclosed"
}
],
"title": "Redux Framework \u003c= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-5399",
"datePublished": "2026-09-10T09:27:08.744Z",
"dateReserved": "2026-04-02T06:19:06.082Z",
"dateUpdated": "2026-09-10T12:55:57.736Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10795 (GCVE-0-2026-10795)
Vulnerability from nvd – Published: 2026-06-11 05:34 – Updated: 2026-06-11 14:37Title
UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc
Summary
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-11 14:37 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | UpdraftPlus: WP Backup & Migration Plugin |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10795",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-11T14:37:25.695215Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-11T14:37:38.538Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UpdraftPlus: WP Backup \u0026 Migration Plugin",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "XU WEI TING"
}
],
"descriptions": [
{
"lang": "en",
"value": "The UpdraftPlus: WP Backup \u0026 Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-11T05:34:20.360Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e901c2a0-2477-4b9a-8483-6002419e0a2f?source=cve"
},
{
"url": "https://plugins.svn.wordpress.org/updraftplus/tags/1.26.4/vendor/team-updraft/common-libs/src/updraft-rpc/class-udrpc2.php"
},
{
"url": "https://plugins.svn.wordpress.org/updraftplus/tags/1.26.4/vendor/team-updraft/common-libs/src/updraft-rpc/class-udrpc.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3561938/updraftplus/trunk/vendor/team-updraft/common-libs/src/updraft-rpc/class-udrpc2.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-03T21:23:51.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-06-10T16:41:29.000Z",
"value": "Disclosed"
}
],
"title": "UpdraftPlus: WP Backup \u0026 Migration Plugin \u003c= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-10795",
"datePublished": "2026-06-11T05:34:20.360Z",
"dateReserved": "2026-06-03T21:07:44.434Z",
"dateUpdated": "2026-06-11T14:37:38.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8438 (GCVE-0-2026-8438)
Vulnerability from nvd – Published: 2026-06-06 01:26 – Updated: 2026-06-06 11:44
VLAI
EPSS
VEX
Title
All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path
Summary
The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the get_rest_route() function and missing output escaping in the column_default() method of the debug log list table. When the 'Disable REST API for non-logged in users' feature (aiowps_disallow_unauthorized_rest_requests) is enabled alongside debug logging (aiowps_enable_debug), an unauthenticated attacker can embed arbitrary HTML or JavaScript in the REST request path. The path is retrieved via urldecode($_SERVER['REQUEST_URI']), which decodes URL-encoded payloads into literal HTML characters. This decoded, unsanitized value is concatenated directly into a debug log message and stored in the database. When an administrator navigates to the AIOS Dashboard Debug Logs page, the column_default() method returns the raw database value without escaping, and the parent list table echoes it directly, causing JavaScript execution in the administrator's browser session. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the debug log page, enabling nonce theft, privileged AJAX/REST actions, and potential full site compromise.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-06 11:35 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | All-In-One Security (AIOS) – Security and Firewall |
Affected:
0 , ≤ 5.4.7
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8438",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-06T11:35:33.670566Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-06T11:44:40.204Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "All-In-One Security (AIOS) \u2013 Security and Firewall",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "5.4.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dmitrii Ignatyev"
}
],
"descriptions": [
{
"lang": "en",
"value": "The All-In-One Security (AIOS) \u2013 Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the get_rest_route() function and missing output escaping in the column_default() method of the debug log list table. When the \u0027Disable REST API for non-logged in users\u0027 feature (aiowps_disallow_unauthorized_rest_requests) is enabled alongside debug logging (aiowps_enable_debug), an unauthenticated attacker can embed arbitrary HTML or JavaScript in the REST request path. The path is retrieved via urldecode($_SERVER[\u0027REQUEST_URI\u0027]), which decodes URL-encoded payloads into literal HTML characters. This decoded, unsanitized value is concatenated directly into a debug log message and stored in the database. When an administrator navigates to the AIOS Dashboard Debug Logs page, the column_default() method returns the raw database value without escaping, and the parent list table echoes it directly, causing JavaScript execution in the administrator\u0027s browser session. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the debug log page, enabling nonce theft, privileged AJAX/REST actions, and potential full site compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-06T01:26:10.529Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b7ed73-a654-40ef-8d80-6171393da8e7?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/admin/wp-security-list-debug.php#L43"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/admin/wp-security-list-debug.php#L43"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-utility.php#L1547"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-utility.php#L1547"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-general-init-tasks.php#L887"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-general-init-tasks.php#L887"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-debug-logger.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-debug-logger.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3558989/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-12T19:06:11.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-06-05T11:51:22.000Z",
"value": "Disclosed"
}
],
"title": "All-In-One Security (AIOS) \u003c= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-8438",
"datePublished": "2026-06-06T01:26:10.529Z",
"dateReserved": "2026-05-12T18:50:59.037Z",
"dateUpdated": "2026-06-06T11:44:40.204Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7660 (GCVE-0-2026-7660)
Vulnerability from nvd – Published: 2026-05-28 06:45 – Updated: 2026-05-28 10:33
VLAI
EPSS
VEX
Title
Easy Updates Manager <= 9.0.20 - Reflected Cross-Site Scripting via 'paged' Parameter
Summary
The Easy Updates Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in versions up to, and including, 9.0.20 This is due to insufficient input sanitization and output escaping in the pagination() function. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page granted they can trick an administrator into performing an action such as clicking on a link.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-28 10:26 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | Easy Updates Manager |
Affected:
0 , ≤ 9.0.20
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7660",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-28T10:26:58.298078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-28T10:33:53.918Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Easy Updates Manager",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "9.0.20",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dmitrii Ignatyev"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Easy Updates Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027paged\u0027 parameter in versions up to, and including, 9.0.20 This is due to insufficient input sanitization and output escaping in the pagination() function. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page granted they can trick an administrator into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-28T06:45:42.024Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bbbd989c-4d69-45c9-bcb9-44f9ab98b969?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/stops-core-theme-and-plugin-updates/trunk/includes/MPSUM_List_Table.php#L800"
},
{
"url": "https://plugins.trac.wordpress.org/browser/stops-core-theme-and-plugin-updates/tags/9.0.20/includes/MPSUM_List_Table.php#L800"
},
{
"url": "https://plugins.trac.wordpress.org/browser/stops-core-theme-and-plugin-updates/trunk/includes/MPSUM_Plugins_List_Table.php#L55"
},
{
"url": "https://plugins.trac.wordpress.org/browser/stops-core-theme-and-plugin-updates/tags/9.0.20/includes/MPSUM_Plugins_List_Table.php#L55"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3531188/stops-core-theme-and-plugin-updates/trunk/includes/MPSUM_List_Table.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fstops-core-theme-and-plugin-updates/tags/9.0.20\u0026new_path=%2Fstops-core-theme-and-plugin-updates/tags/9.0.21"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-01T19:43:31.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-05-27T18:13:25.000Z",
"value": "Disclosed"
}
],
"title": "Easy Updates Manager \u003c= 9.0.20 - Reflected Cross-Site Scripting via \u0027paged\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-7660",
"datePublished": "2026-05-28T06:45:42.024Z",
"dateReserved": "2026-05-01T19:28:13.961Z",
"dateUpdated": "2026-05-28T10:33:53.918Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7252 (GCVE-0-2026-7252)
Vulnerability from nvd – Published: 2026-05-07 04:27 – Updated: 2026-05-07 14:15
VLAI
EPSS
VEX
Title
WP-Optimize <= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta
Summary
The WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in all versions up to, and including, 4.5.2 This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is possible because 'original-file' is a public (non-protected) meta key — it does not begin with an underscore — allowing Authors to freely create or modify it on their own attachment posts via the standard Edit Media form or the REST API.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-07 14:15 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance |
Affected:
0 , ≤ 4.5.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7252",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-07T14:15:17.661876Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-07T14:15:26.842Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP-Optimize \u2013 Cache, Compress images, Minify \u0026 Clean database to boost page speed \u0026 performance",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ly Hoang"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP-Optimize \u2013 Cache, Compress images, Minify \u0026 Clean database to boost page speed \u0026 performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in all versions up to, and including, 4.5.2 This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is possible because \u0027original-file\u0027 is a public (non-protected) meta key \u2014 it does not begin with an underscore \u2014 allowing Authors to freely create or modify it on their own attachment posts via the standard Edit Media form or the REST API."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-07T04:27:10.902Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cc815ef2-dd02-4faa-b202-dd1552f889db?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/trunk/includes/class-updraft-smush-manager.php#L1649"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/tags/4.5.2/includes/class-updraft-smush-manager.php#L1649"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/trunk/includes/class-updraft-smush-manager.php#L1645"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/tags/4.5.2/includes/class-updraft-smush-manager.php#L1645"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/trunk/includes/class-updraft-smush-manager.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/tags/4.5.2/includes/class-updraft-smush-manager.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3518513/wp-optimize/trunk/includes/class-updraft-smush-manager.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-optimize/tags/4.5.2\u0026new_path=%2Fwp-optimize/tags/4.5.3"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-27T19:26:04.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-05-06T15:34:39.000Z",
"value": "Disclosed"
}
],
"title": "WP-Optimize \u003c= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via \u0027original-file\u0027 Post Meta"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-7252",
"datePublished": "2026-05-07T04:27:10.902Z",
"dateReserved": "2026-04-27T19:09:53.550Z",
"dateUpdated": "2026-05-07T14:15:26.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-13362 (GCVE-0-2024-13362)
Vulnerability from nvd – Published: 2026-05-01 05:29 – Updated: 2026-05-01 13:23
VLAI
EPSS
VEX
Title
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Summary
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-01 13:23 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
24 references
Impacted products
131 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13362",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-01T13:23:14.835839Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-01T13:23:26.723Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Go Fetch Jobs (for WP Job Manager)",
"vendor": "sebet",
"versions": [
{
"lessThanOrEqual": "1.8.4.8.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dynamic Copyright Year",
"vendor": "5starplugins",
"versions": [
{
"lessThanOrEqual": "1.0.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Code Manager",
"vendor": "peterschulznl",
"versions": [
{
"lessThanOrEqual": "1.0.40",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Advanced Scrollbar \u2013 Custom Scrollbar Styling and Behavior",
"vendor": "bplugins",
"versions": [
{
"lessThanOrEqual": "1.1.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Goal Tracker \u2013 Custom Event Tracking for GA4",
"vendor": "yuvalo",
"versions": [
{
"lessThanOrEqual": "1.1.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent",
"vendor": "essekia",
"versions": [
{
"lessThanOrEqual": "1.1.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Page Templates",
"vendor": "josevega",
"versions": [
{
"lessThanOrEqual": "1.1.16",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Payment Gateway for ACBA BANK",
"vendor": "hkdigitalagency",
"versions": [
{
"lessThanOrEqual": "1.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dracula Dark Mode \u2013 Accessibility, Reading Mode \u0026 Dark Mode for WordPress",
"vendor": "princeahmed",
"versions": [
{
"lessThanOrEqual": "1.2.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Forumax \u2013 AI Powered Advanced Community Forum Plugin",
"vendor": "spiderdevs",
"versions": [
{
"lessThanOrEqual": "1.2.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Five-Star Ratings Shortcode",
"vendor": "seezee",
"versions": [
{
"lessThanOrEqual": "1.2.56",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Product Layouts for WooCommerce",
"vendor": "oxilab",
"versions": [
{
"lessThanOrEqual": "1.3.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Meta Field Block \u2013 Display custom fields in the Block Editor without coding",
"vendor": "mr2p",
"versions": [
{
"lessThanOrEqual": "1.3.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Custom WooCommerce Checkout Fields Editor",
"vendor": "themelocation",
"versions": [
{
"lessThanOrEqual": "1.3.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Open User Map",
"vendor": "100plugins",
"versions": [
{
"lessThanOrEqual": "1.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Notification Bell",
"vendor": "wpdever",
"versions": [
{
"lessThanOrEqual": "1.4.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Remove Add to Cart WooCommerce",
"vendor": "themelocation",
"versions": [
{
"lessThanOrEqual": "1.4.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "File Manager for Google Drive \u2013 Integrate Google Drive",
"vendor": "princeahmed",
"versions": [
{
"lessThanOrEqual": "1.4.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Marijuana Age Verify",
"vendor": "5starplugins",
"versions": [
{
"lessThanOrEqual": "1.5.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RevivePress \u2013 Keep your Old Content Evergreen",
"vendor": "infosatech",
"versions": [
{
"lessThanOrEqual": "1.5.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Restaurant \u0026 Cafe Addon for Elementor",
"vendor": "nicheaddons",
"versions": [
{
"lessThanOrEqual": "1.5.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Send Users Email \u2013 Email Subscribers, Email Marketing Newsletter",
"vendor": "paretodigital",
"versions": [
{
"lessThanOrEqual": "1.5.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Unlimited Elements For Elementor",
"vendor": "unitecms",
"versions": [
{
"lessThanOrEqual": "1.5.140",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Role Based Pricing for Woo by Meow Crew",
"vendor": "meowcrew",
"versions": [
{
"lessThanOrEqual": "1.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Primary Addon for Elementor",
"vendor": "nicheaddons",
"versions": [
{
"lessThanOrEqual": "1.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Featured Images in RSS for Mailchimp \u0026 More",
"vendor": "5starplugins",
"versions": [
{
"lessThanOrEqual": "1.6.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Image Alt Text Manager \u2013 Bulk \u0026 Dynamic Alt Tags For image SEO Optimization + AI",
"vendor": "wpsaad",
"versions": [
{
"lessThanOrEqual": "1.6.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Message Filter for Contact Form 7",
"vendor": "kofimokome",
"versions": [
{
"lessThanOrEqual": "1.6.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Embedder for Google Reviews",
"vendor": "paretodigital",
"versions": [
{
"lessThanOrEqual": "1.6.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MapGeo \u2013 Interactive Geo Maps",
"vendor": "interactivegeomaps",
"versions": [
{
"lessThanOrEqual": "1.6.22",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WPBITS Addons For Elementor Page Builder",
"vendor": "wpbits",
"versions": [
{
"lessThanOrEqual": "1.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Widgets on Pages",
"vendor": "toddhalfpenny",
"versions": [
{
"lessThanOrEqual": "1.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Spotlight Social Feeds \u2013 Block, Shortcode, and Widget",
"vendor": "rebelcode",
"versions": [
{
"lessThanOrEqual": "1.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WOW Styler for CF7 \u2013 Visual Styler for Contact Form 7 Forms",
"vendor": "tobias_conrad",
"versions": [
{
"lessThanOrEqual": "1.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AI Bud \u2013 AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o",
"vendor": "webfactory",
"versions": [
{
"lessThanOrEqual": "1.7.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Text To Speech TTS Accessibility",
"vendor": "hasanazizul",
"versions": [
{
"lessThanOrEqual": "1.7.34",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Easy Age Verify",
"vendor": "5starplugins",
"versions": [
{
"lessThanOrEqual": "1.8.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AI Puffer \u2013 Chat. Create. Automate. (formerly AI Power)",
"vendor": "senols",
"versions": [
{
"lessThanOrEqual": "1.8.99",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Justified Gallery",
"vendor": "damian-gora",
"versions": [
{
"lessThanOrEqual": "1.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mapster WP Maps",
"vendor": "mapster",
"versions": [
{
"lessThanOrEqual": "1.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "StreamWeasels Twitch Integration",
"vendor": "streamweasels",
"versions": [
{
"lessThanOrEqual": "1.9.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XT Variation Swatches for WooCommerce",
"vendor": "xplodedthemes",
"versions": [
{
"lessThanOrEqual": "1.9.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "bBlocks \u2013 Essential Gutenberg Blocks \u0026 Patterns Collection",
"vendor": "bplugins",
"versions": [
{
"lessThanOrEqual": "1.9.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "URL Shortify \u2013 Simple and Easy URL Shortener",
"vendor": "kaizencoders",
"versions": [
{
"lessThanOrEqual": "1.10.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Kikote \u2013 Location Picker at Checkout \u0026 Google Address AutoFill Plugin for WooCommerce",
"vendor": "uriahs-victor",
"versions": [
{
"lessThanOrEqual": "1.10.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Geo Mashup",
"vendor": "cyberhobo",
"versions": [
{
"lessThanOrEqual": "1.13.15",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Disable Payment Methods based on cart conditions for WooCommerce",
"vendor": "josevega",
"versions": [
{
"lessThanOrEqual": "1.16.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Automatic Internal Links for SEO by Pagup",
"vendor": "pagup",
"versions": [
{
"lessThanOrEqual": "2.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Full Screen Background",
"vendor": "enweby",
"versions": [
{
"lessThanOrEqual": "2.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Master Addons For Elementor \u2013 Widgets, Extensions, Theme Builder, Popup Builder \u0026 Template Kits",
"vendor": "litonice13",
"versions": [
{
"lessThanOrEqual": "2.0.7.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player",
"vendor": "princeahmed",
"versions": [
{
"lessThanOrEqual": "2.0.82",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Carousel, Recent Post Slider and Banner Slider",
"vendor": "spicethemes",
"versions": [
{
"lessThanOrEqual": "2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)",
"vendor": "pagup",
"versions": [
{
"lessThanOrEqual": "2.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XT Quick View for WooCommerce",
"vendor": "xplodedthemes",
"versions": [
{
"lessThanOrEqual": "2.1.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart phone field for Gravity Forms",
"vendor": "pluginscafe",
"versions": [
{
"lessThanOrEqual": "2.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Notification Bar, Announcement and Cookie Notice WordPress Plugin \u2013 FooBar",
"vendor": "fooplugins",
"versions": [
{
"lessThanOrEqual": "2.1.34",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PDF Poster \u2013 Display PDF Files with Custom Viewer",
"vendor": "bplugins",
"versions": [
{
"lessThanOrEqual": "2.2.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Events Addon for Elementor",
"vendor": "nicheaddons",
"versions": [
{
"lessThanOrEqual": "2.2.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HTML5 Audio Player \u2013 The Ultimate No-Code Podcast, MP3 \u0026 Audio Player",
"vendor": "bplugins",
"versions": [
{
"lessThanOrEqual": "2.2.27",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Glossary",
"vendor": "mte90",
"versions": [
{
"lessThanOrEqual": "2.2.38",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Restrict \u2013 membership, site, content and user access restrictions for WordPress",
"vendor": "tickera",
"versions": [
{
"lessThanOrEqual": "2.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Custom PHP Settings",
"vendor": "cyclonecode",
"versions": [
{
"lessThanOrEqual": "2.3.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Meta and Date Remover",
"vendor": "prasadkirpekar",
"versions": [
{
"lessThanOrEqual": "2.3.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Anti-Spam Protection \u2013 No API Key, GDPR Friendly",
"vendor": "fullworks",
"versions": [
{
"lessThanOrEqual": "2.3.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Premmerce Permalink Manager for WooCommerce",
"vendor": "premmerce",
"versions": [
{
"lessThanOrEqual": "2.3.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Music Player for Elementor \u2013 Audio Player \u0026 Podcast Player",
"vendor": "smartwpress",
"versions": [
{
"lessThanOrEqual": "2.4.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TopNewsWp \u2013 Display Tikcer News, RSS Feed Widget and Many More",
"vendor": "mhmrajib",
"versions": [
{
"lessThanOrEqual": "2.4.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Ocean Extra",
"vendor": "oceanwp",
"versions": [
{
"lessThanOrEqual": "2.4.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Gallery by FooGallery",
"vendor": "fooplugins",
"versions": [
{
"lessThanOrEqual": "2.4.27",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Automatic YouTube Gallery",
"vendor": "plugins360",
"versions": [
{
"lessThanOrEqual": "2.5.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EazyDocs \u2013 AI Powered Knowledge Base, Wiki, Documentation \u0026 FAQ Builder",
"vendor": "spiderdevs",
"versions": [
{
"lessThanOrEqual": "2.5.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Team Members \u2013 A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More",
"vendor": "samdani",
"versions": [
{
"lessThanOrEqual": "2.5.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Radio Station by netmix\u00ae \u2013 Manage and play your Show Schedule in WordPress!",
"vendor": "tonyzeoli",
"versions": [
{
"lessThanOrEqual": "2.5.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "StoreCustomizer \u2013 A plugin to Customize all WooCommerce Pages",
"vendor": "kaira",
"versions": [
{
"lessThanOrEqual": "2.5.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Joli Table Of Contents",
"vendor": "wpjoli",
"versions": [
{
"lessThanOrEqual": "2.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GA4WP \u2013 Analytics Dashboard for the Website",
"vendor": "passionatebrains",
"versions": [
{
"lessThanOrEqual": "2.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Place Order Without Payment for WooCommerce",
"vendor": "nitin247",
"versions": [
{
"lessThanOrEqual": "2.6.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Better Messages \u2013 Live Chat, Chat Rooms, Real-Time Messaging \u0026 Private Messages",
"vendor": "wordplus",
"versions": [
{
"lessThanOrEqual": "2.6.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Share This Image",
"vendor": "mihail-barinov",
"versions": [
{
"lessThanOrEqual": "2.07",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Inavii Social Feed",
"vendor": "inavii",
"versions": [
{
"lessThanOrEqual": "2.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Lightbox \u0026 Modal Popup WordPress Plugin \u2013 FooBox",
"vendor": "fooplugins",
"versions": [
{
"lessThanOrEqual": "2.7.33",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XT Floating Cart for WooCommerce",
"vendor": "xplodedthemes",
"versions": [
{
"lessThanOrEqual": "2.8.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Mobile Menu \u2013 The Mobile-Friendly Responsive Menu",
"vendor": "takanakui",
"versions": [
{
"lessThanOrEqual": "2.8.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading \u0026 Image Optimization",
"vendor": "passionatebrains",
"versions": [
{
"lessThanOrEqual": "2.9.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Independent Analytics",
"vendor": "bensibley",
"versions": [
{
"lessThanOrEqual": "2.9.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Knowledge Base documentation \u0026 wiki plugin \u2013 BasePress Docs",
"vendor": "codesavory",
"versions": [
{
"lessThanOrEqual": "2.16.3.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Internal Link Juicer: SEO Auto Linker for WordPress",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "2.24.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Bulk Edit Posts and Products in Spreadsheet",
"vendor": "josevega",
"versions": [
{
"lessThanOrEqual": "2.25.16",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
"vendor": "saadiqbal",
"versions": [
{
"lessThanOrEqual": "3.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TablePress \u2013 Tables in WordPress made easy",
"vendor": "tobiasbg",
"versions": [
{
"lessThanOrEqual": "3.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Ultimeter",
"vendor": "bouncingsprout",
"versions": [
{
"lessThanOrEqual": "3.0.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TreePress \u2013 Easy Family Trees \u0026 Ancestor Profiles",
"vendor": "blackandwhitedigital",
"versions": [
{
"lessThanOrEqual": "3.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Pay For Post with WooCommerce",
"vendor": "mattpramschufer",
"versions": [
{
"lessThanOrEqual": "3.1.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Post to Google My Business (Google Business Profile)",
"vendor": "koen12344",
"versions": [
{
"lessThanOrEqual": "3.1.28",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Coupons and Deals \u2013 Coupon Plugin For Affiliate Marketers",
"vendor": "imtiazrayhan",
"versions": [
{
"lessThanOrEqual": "3.2.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Advanced Classifieds \u0026 Directory Pro",
"vendor": "pluginsware",
"versions": [
{
"lessThanOrEqual": "3.2.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mixed Media Gallery Blocks",
"vendor": "gallerycreator",
"versions": [
{
"lessThanOrEqual": "3.2.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "BlockSpare \u2014 News, Magazine and Blog Addons for (Gutenberg) Block Editor",
"vendor": "blockspare",
"versions": [
{
"lessThanOrEqual": "3.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AidWP \u2013 Donation \u0026 Payment Forms (Stripe Powered)",
"vendor": "mhmrajib",
"versions": [
{
"lessThanOrEqual": "3.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Logo Showcase \u2013 Responsive Logo Carousel, Logo Slider \u0026 Logo Grid",
"vendor": "infornweb",
"versions": [
{
"lessThanOrEqual": "3.2.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Post Slider and Post Carousel with Post Vertical Scrolling Widget \u2013 A Responsive Post Slider",
"vendor": "pluginandplay",
"versions": [
{
"lessThanOrEqual": "3.2.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Solid Testimonials \u2013 Testimonial Slider, Video Testimonials \u0026 Customer Reviews",
"vendor": "samdani",
"versions": [
{
"lessThanOrEqual": "3.2.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Team Members Showcase",
"vendor": "wpspeedo",
"versions": [
{
"lessThanOrEqual": "3.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EleSpare \u2013 News, Magazine and Blog Addons for Elementor",
"vendor": "elespare",
"versions": [
{
"lessThanOrEqual": "3.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Post List Designer \u2013 Category Post, Recent Post, Post List",
"vendor": "infornweb",
"versions": [
{
"lessThanOrEqual": "3.3.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Blog Designer Pack \u2013 Blog, Post Grid, Post Slider, Post Carousel, Category Post, News",
"vendor": "infornweb",
"versions": [
{
"lessThanOrEqual": "3.4.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "YASR \u2013 Yet Another Star Rating Plugin for WordPress",
"vendor": "dashlabsltd",
"versions": [
{
"lessThanOrEqual": "3.4.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WPIDE \u2013 File Manager \u0026 Code Editor",
"vendor": "xplodedthemes",
"versions": [
{
"lessThanOrEqual": "3.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Premmerce Product Filter for WooCommerce",
"vendor": "premmerce",
"versions": [
{
"lessThanOrEqual": "3.7.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors \u0026 Custom Avatars",
"vendor": "afthemes",
"versions": [
{
"lessThanOrEqual": "3.8.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Delete Posts automatically",
"vendor": "wpmagics",
"versions": [
{
"lessThanOrEqual": "3.9.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Menu Image, Icons made easy",
"vendor": "takanakui",
"versions": [
{
"lessThanOrEqual": "3.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AWCA \u2013 The Great Analytics Insights for Your eStore",
"vendor": "passionatebrains",
"versions": [
{
"lessThanOrEqual": "3.12.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Announcement \u0026 Notification Banner \u2013 Bulletin",
"vendor": "mikewire_rocksolid",
"versions": [
{
"lessThanOrEqual": "3.12.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Thank You Page for WooCommerce",
"vendor": "nitin247",
"versions": [
{
"lessThanOrEqual": "4.2.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Contact Form 7 Multi-Step Forms",
"vendor": "webheadllc",
"versions": [
{
"lessThanOrEqual": "4.4.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Auto-Install Free SSL \u2013 Generate \u0026 Install Free SSL Certificates",
"vendor": "speedify",
"versions": [
{
"lessThanOrEqual": "4.5.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Books Gallery \u2013 Build Stunning Book Showcases \u0026 Libraries in Minutes",
"vendor": "mhmrajib",
"versions": [
{
"lessThanOrEqual": "4.6.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Easy Appointment Booking \u0026 Scheduling System \u2013 Webba Booking Calendar",
"vendor": "webba-agency",
"versions": [
{
"lessThanOrEqual": "5.0.57",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP fail2ban \u2013 Advanced Security",
"vendor": "invisnet",
"versions": [
{
"lessThanOrEqual": "5.3.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Ivory Search \u2013 WordPress Search Plugin",
"vendor": "vinod-dalvi",
"versions": [
{
"lessThanOrEqual": "5.5.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Data Access \u2013 App Builder for Tables, Forms, Charts, Maps \u0026 Dashboards",
"vendor": "peterschulznl",
"versions": [
{
"lessThanOrEqual": "5.5.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce",
"vendor": "elliotvs",
"versions": [
{
"lessThanOrEqual": "5.17.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Security Ninja \u2013 WordPress Security \u0026 Firewall",
"vendor": "cleverplugins",
"versions": [
{
"lessThanOrEqual": "5.222",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Checkout with Cash App on WooCommerce",
"vendor": "theafricanboss",
"versions": [
{
"lessThanOrEqual": "6.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Display Eventbrite Events",
"vendor": "fullworks",
"versions": [
{
"lessThanOrEqual": "6.1.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins",
"vendor": "mohsinoffline",
"versions": [
{
"lessThanOrEqual": "6.1.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Easy Social Feed \u2013 Social Photos Gallery and Post Feed for WordPress",
"vendor": "sjaved",
"versions": [
{
"lessThanOrEqual": "6.6.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
"vendor": "gn_themes",
"versions": [
{
"lessThanOrEqual": "7.3.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Encryption \u2013 One Click Free SSL Certificate \u0026 SSL / HTTPS Redirect, Security \u0026 SSL Scan",
"vendor": "gowebsmarty",
"versions": [
{
"lessThanOrEqual": "7.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto",
"vendor": "tripetto",
"versions": [
{
"lessThanOrEqual": "8.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Asaf Mozes"
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-01T05:29:54.148Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tablepress/trunk/libraries/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widgets-on-pages/trunk/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/menu-image/trunk/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.7.33/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/featured-images-for-rss-feeds/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpide/tags/3.5.0/dist/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/add-search-to-menu/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/master-addons/trunk/lib/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.27/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ocean-extra/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/internal-links/trunk/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/interactive-geo-maps/tags/1.6.21/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/independent-analytics/trunk/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/spotlight-social-photo-feeds/trunk/ui/freemius-pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-permalink-manager/tags/2.3.11/assets/admin/js/pricing-page/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pdf-poster/trunk/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-meta-and-date-remover/tags/2.3.4/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3235286/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3249130/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3229060/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-30T17:32:32.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-04-30T17:17:30.000Z",
"value": "Disclosed"
}
],
"title": "Freemius \u003c= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-13362",
"datePublished": "2026-05-01T05:29:54.148Z",
"dateReserved": "2025-01-13T18:08:47.439Z",
"dateUpdated": "2026-05-01T13:23:26.723Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2712 (GCVE-0-2026-2712)
Vulnerability from nvd – Published: 2026-04-10 01:24 – Updated: 2026-04-10 13:46
VLAI
EPSS
VEX
Title
WP-Optimize <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation
Summary
The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the `receive_heartbeat()` function in `includes/class-wp-optimize-heartbeat.php` in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly invoking `Updraft_Smush_Manager_Commands` methods without verifying user capabilities, nonce tokens, or the allowed commands whitelist that the normal AJAX handler (`updraft_smush_ajax`) enforces. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke admin-only Smush operations including reading log files (`get_smush_logs`), deleting all backup images (`clean_all_backup_images`), triggering bulk image processing (`process_bulk_smush`), and modifying Smush options (`update_smush_options`).
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-10 13:46 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance |
Affected:
0 , ≤ 4.5.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2712",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-10T13:46:09.364998Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T13:46:16.718Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP-Optimize \u2013 Cache, Compress images, Minify \u0026 Clean database to boost page speed \u0026 performance",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dmitrii Ignatyev"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the `receive_heartbeat()` function in `includes/class-wp-optimize-heartbeat.php` in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly invoking `Updraft_Smush_Manager_Commands` methods without verifying user capabilities, nonce tokens, or the allowed commands whitelist that the normal AJAX handler (`updraft_smush_ajax`) enforces. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke admin-only Smush operations including reading log files (`get_smush_logs`), deleting all backup images (`clean_all_backup_images`), triggering bulk image processing (`process_bulk_smush`), and modifying Smush options (`update_smush_options`)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T01:24:57.952Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6a0a376e-ea3a-40ca-9341-f28f92e15e02?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/tags/4.4.1/includes/class-wp-optimize-heartbeat.php#L65"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/trunk/includes/class-wp-optimize-heartbeat.php#L65"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/tags/4.4.1/includes/class-wp-optimize-heartbeat.php#L82"
},
{
"url": "https://research.cleantalk.org/cve-2026-2712/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-03T12:42:09.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-04-09T11:52:37.000Z",
"value": "Disclosed"
}
],
"title": "WP-Optimize \u003c= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-2712",
"datePublished": "2026-04-10T01:24:57.952Z",
"dateReserved": "2026-02-18T20:31:43.704Z",
"dateUpdated": "2026-04-10T13:46:16.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-9488 (GCVE-0-2025-9488)
Vulnerability from nvd – Published: 2025-12-13 04:31 – Updated: 2026-04-08 17:23
VLAI
EPSS
VEX
Title
Redux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter
Summary
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 4.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-15 15:43 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | Redux Framework |
Affected:
0 , ≤ 4.5.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9488",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-15T15:43:04.148093Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-15T15:46:53.451Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Redux Framework",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Muhammad Yudha - DJ"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018data\u2019 parameter in all versions up to, and including, 4.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:23:21.320Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cabf776d-8749-45a8-94c1-7d1eef93a183?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.7/redux-core/inc/extensions/shortcodes/class-redux-shortcodes.php#L205"
},
{
"url": "https://wordpress.org/plugins/redux-framework/#developers"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3402803%40redux-framework\u0026new=3402803%40redux-framework\u0026sfp_email=\u0026sfph_mail=#file22"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-11-19T16:55:59.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2025-12-12T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Redux Framework \u003c= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-9488",
"datePublished": "2025-12-13T04:31:33.327Z",
"dateReserved": "2025-08-26T12:49:36.739Z",
"dateUpdated": "2026-04-08T17:23:21.320Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-13857 (GCVE-0-2024-13857)
Vulnerability from nvd – Published: 2025-03-07 09:21 – Updated: 2026-04-08 17:23
VLAI
EPSS
VEX
Title
WPGet API <= 2.2.10 - Authenticated (Administrator+) Server-Side Request Forgery
Summary
The WPGet API – Connect to any external REST API plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-07 13:35 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | WPGet API – Connect to any external REST API |
Affected:
0 , ≤ 2.2.10
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13857",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-07T13:35:50.583158Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-07T13:36:06.585Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPGet API \u2013 Connect to any external REST API",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "2.2.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Francesco Carlucci"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPGet API \u2013 Connect to any external REST API plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:23:59.917Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cd2a8e7b-6fca-49f3-ba6d-bdaa418f611a?source=cve"
},
{
"url": "https://wordpress.org/plugins/wpgetapi/#developers"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3251647/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-03-06T20:56:52.000Z",
"value": "Disclosed"
}
],
"title": "WPGet API \u003c= 2.2.10 - Authenticated (Administrator+) Server-Side Request Forgery"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-13857",
"datePublished": "2025-03-07T09:21:14.921Z",
"dateReserved": "2025-02-10T22:55:29.229Z",
"dateUpdated": "2026-04-08T17:23:59.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-0215 (GCVE-0-2025-0215)
Vulnerability from nvd – Published: 2025-01-15 22:23 – Updated: 2026-04-08 17:15
VLAI
EPSS
VEX
Title
UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scripting
Summary
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the showdata and initiate_restore parameters in all versions up to, and including, 1.24.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-16 14:22 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | UpdraftPlus: WP Backup & Migration Plugin |
Affected:
0 , ≤ 1.24.12
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0215",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-16T14:22:40.334371Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-16T18:43:27.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UpdraftPlus: WP Backup \u0026 Migration Plugin",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "1.24.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Asaf Mozes"
}
],
"descriptions": [
{
"lang": "en",
"value": "The UpdraftPlus: WP Backup \u0026 Migration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the showdata and initiate_restore parameters in all versions up to, and including, 1.24.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:15:33.397Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/af568eea-59ce-467e-ba03-625d04d3db6e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/updraftplus/tags/1.24.12/includes/updraft-admin-common.js#L4404"
},
{
"url": "https://plugins.trac.wordpress.org/browser/updraftplus/tags/1.24.12/includes/updraft-admin-common.js#L4439"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-12-25T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2025-01-15T09:43:13.000Z",
"value": "Disclosed"
}
],
"title": "UpdraftPlus - Backup/Restore \u003c= 1.24.12 - Reflected Cross-Site Scripting"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-0215",
"datePublished": "2025-01-15T22:23:32.852Z",
"dateReserved": "2025-01-03T19:31:41.889Z",
"dateUpdated": "2026-04-08T17:15:33.397Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-10957 (GCVE-0-2024-10957)
Vulnerability from nvd – Published: 2025-01-04 13:41 – Updated: 2025-01-06 16:37
VLAI
EPSS
VEX
Title
UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection
Summary
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserialization of untrusted input in the 'recursive_unserialized_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. An administrator must perform a search and replace action to trigger the exploit.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-06 16:18 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | UpdraftPlus: WP Backup & Migration Plugin |
Affected:
1.23.8 , ≤ 1.24.11
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10957",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-06T16:18:42.953815Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-06T16:26:51.896Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UpdraftPlus: WP Backup \u0026 Migration Plugin",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "1.24.11",
"status": "affected",
"version": "1.23.8",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Craig Smith"
}
],
"descriptions": [
{
"lang": "en",
"value": "The UpdraftPlus: WP Backup \u0026 Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserialization of untrusted input in the \u0027recursive_unserialized_replace\u0027 function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. An administrator must perform a search and replace action to trigger the exploit."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-06T16:37:04.468Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4729ed37-96b2-4717-8a72-89b9a21ec058?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/updraftplus/trunk/includes/class-search-replace.php#L411"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3212299/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-01-03T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "UpdraftPlus: WP Backup \u0026 Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-10957",
"datePublished": "2025-01-04T13:41:07.531Z",
"dateReserved": "2024-11-06T23:03:29.760Z",
"dateUpdated": "2025-01-06T16:37:04.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-90992 (GCVE-0-2026-90992)
Vulnerability from cvelistv5 – Published: 2026-10-01 08:28 – Updated: 2026-10-01 18:25
VLAI
EPSS
VEX
Title
Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field
Summary
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users who can store a payload in user meta fields such as the biography, session_tokens (via a crafted User-Agent at login), or persisted_preferences (via the REST API), which are then promoted to the site-wide redux_demo option when a media URL repair is triggered on the demo panel.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 18:24 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | Redux Framework |
Affected:
0 , ≤ 4.5.14
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90992",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T18:24:23.758653Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T18:25:50.057Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Redux Framework",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "daroo"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via \u0027user-mediaurl\u0027 Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users who can store a payload in user meta fields such as the biography, session_tokens (via a crafted User-Agent at login), or persisted_preferences (via the REST API), which are then promoted to the site-wide redux_demo option when a media URL repair is triggered on the demo panel."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T08:28:41.178Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2274a464-4eeb-4c8a-b138-44fef6b4a3a5?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/assets/js/vendor/jsonview.js#L136"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/users/class-redux-extension-users.php#L365"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/users/class-redux-users-api.php#L558"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/classes/class-redux-options-constructor.php#L632"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/classes/class-redux-options-constructor.php#L189"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3705066%40redux-framework%2Ftags%2F4.5.15\u0026old=3688279%40redux-framework%2Ftags%2F4.5.14"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3705066/redux-framework/trunk/redux-core/assets/js/vendor/jsonview.js"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-14T15:22:31.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-30T20:01:14.000Z",
"value": "Disclosed"
}
],
"title": "Redux Framework \u003c= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027user-mediaurl\u0027 Media Field"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-90992",
"datePublished": "2026-10-01T08:28:41.178Z",
"dateReserved": "2026-09-14T14:30:20.066Z",
"dateUpdated": "2026-10-01T18:25:50.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88999 (GCVE-0-2026-88999)
Vulnerability from cvelistv5 – Published: 2026-10-01 05:30 – Updated: 2026-10-03 15:42
VLAI
EPSS
VEX
Title
Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter
Summary
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media library attachments, including administrator-owned files, from the affected site. This is exploitable by Subscribers when a Custom Fonts field is registered on the user profile page via Redux_Users::set_profile(), as doing so causes the required redux_custom_fonts nonce to be rendered into the Subscriber's wp-admin/profile.php page.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:29 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
13 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | Redux Framework |
Affected:
0 , ≤ 4.5.14
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88999",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:29:33.178456Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:42:52.610Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Redux Framework",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eunho Kim"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media library attachments, including administrator-owned files, from the affected site. This is exploitable by Subscribers when a Custom Fonts field is registered on the user profile page via Redux_Users::set_profile(), as doing so causes the required redux_custom_fonts nonce to be rendered into the Subscriber\u0027s wp-admin/profile.php page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T05:30:55.556Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c7e24790-01a0-41bc-a380-60d86c6e1443?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.13/redux-core/inc/extensions/custom_fonts/custom_fonts/class-redux-custom-fonts.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.13/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L338"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.13/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L392"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.13/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L617"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L571"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L617"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L338"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L392"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.14/redux-core/inc/extensions/custom_fonts/custom_fonts/class-redux-custom-fonts.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.13/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L571"
},
{
"url": "https://github.com/reduxframework/redux-framework/pull/4117/changes"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3705066/redux-framework/trunk/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-10T16:30:36.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-30T16:41:29.000Z",
"value": "Disclosed"
}
],
"title": "Redux Framework \u003c= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via \u0027attachment_id\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-88999",
"datePublished": "2026-10-01T05:30:55.556Z",
"dateReserved": "2026-09-10T16:15:30.715Z",
"dateUpdated": "2026-10-03T15:42:52.610Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5410 (GCVE-0-2026-5410)
Vulnerability from cvelistv5 – Published: 2026-09-19 08:27 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input
Summary
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the user_meta_save() function scalar values bypass the sanitization logic that only processes arrays, allowing the spinner field value to be stored in user meta without proper sanitization. Later, at line 56 of class-redux-spinner.php in the render() function, this value is rendered in an unquoted HTML attribute without escaping via '$data_string .= ' data-val=' . $this->value;'. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:17 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | Redux Framework |
Affected:
0 , ≤ 4.5.13
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5410",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:17:57.767016Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:20.094Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Redux Framework",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Luc Huynh from Noventiq RedTeam"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the user_meta_save() function scalar values bypass the sanitization logic that only processes arrays, allowing the spinner field value to be stored in user meta without proper sanitization. Later, at line 56 of class-redux-spinner.php in the render() function, this value is rendered in an unquoted HTML attribute without escaping via \u0027$data_string .= \u0027 data-val=\u0027 . $this-\u003evalue;\u0027. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T08:27:20.952Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/116c57c2-6257-40b3-a838-194f8959be16?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/fields/spinner/class-redux-spinner.php#L56"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/fields/spinner/class-redux-spinner.php#L56"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/extensions/users/class-redux-extension-users.php#L1018"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/extensions/users/class-redux-extension-users.php#L1018"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3688279%40redux-framework%2Ftags%2F4.5.14\u0026old=3582185%40redux-framework%2Ftags%2F4.5.13"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3688279/redux-framework/trunk/redux-core/inc/extensions/users/class-redux-extension-users.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-02T07:19:19.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-18T19:55:15.000Z",
"value": "Disclosed"
}
],
"title": "Redux Framework \u003c= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-5410",
"datePublished": "2026-09-19T08:27:20.952Z",
"dateReserved": "2026-04-02T07:04:02.995Z",
"dateUpdated": "2026-09-19T13:51:20.094Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5400 (GCVE-0-2026-5400)
Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 13:51
VLAI
EPSS
VEX
Title
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input
Summary
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13 This is due to insufficient input sanitization of nested array values in the user_meta_save() function and unsafe output of filter CSS values in the render() function without proper escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 13:25 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | Redux Framework |
Affected:
0 , ≤ 4.5.13
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5400",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T13:25:56.982054Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T13:51:20.891Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Redux Framework",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "h0xilo"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13 This is due to insufficient input sanitization of nested array values in the user_meta_save() function and unsafe output of filter CSS values in the render() function without proper escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T07:43:19.874Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca5b1ff6-19c5-4384-ae63-faf1f40122e7?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/fields/media/class-redux-media.php#L233"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/fields/media/class-redux-media.php#L233"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/fields/media/class-redux-media.php#L337"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/fields/media/class-redux-media.php#L337"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/extensions/users/class-redux-extension-users.php#L1034"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/extensions/users/class-redux-extension-users.php#L1034"
},
{
"url": "https://github.com/reduxframework/redux-framework/pull/4112/changes"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3688279%40redux-framework%2Ftags%2F4.5.14\u0026old=3582185%40redux-framework%2Ftags%2F4.5.13"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3688279/redux-framework/trunk/redux-core/inc/fields/media/class-redux-media.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-02T06:50:46.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-18T19:01:22.000Z",
"value": "Disclosed"
}
],
"title": "Redux Framework \u003c= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-5400",
"datePublished": "2026-09-19T07:43:19.874Z",
"dateReserved": "2026-04-02T06:29:52.259Z",
"dateUpdated": "2026-09-19T13:51:20.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5399 (GCVE-0-2026-5399)
Vulnerability from cvelistv5 – Published: 2026-09-10 09:27 – Updated: 2026-09-10 12:55
VLAI
EPSS
VEX
Title
Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value
Summary
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user_meta_save() function (which only sanitizes array values, not scalar values) and improper output escaping in the Redux_Slider::render() method, which outputs slider values into unquoted HTML attributes. The vulnerability also exploits the fact that the clean_default() method only casts values to numeric types when they are empty or out of bounds, allowing malicious strings like '1 tabindex=0 autofocus onfocus=alert(1) x=' to pass validation through PHP's loose type comparison. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into their user profile that will execute whenever an Administrator navigates to view the attacker's profile page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 12:55 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | Redux Framework |
Affected:
0 , ≤ 4.5.13.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5399",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T12:55:47.555159Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T12:55:57.736Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Redux Framework",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.13.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "h0xilo"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user_meta_save() function (which only sanitizes array values, not scalar values) and improper output escaping in the Redux_Slider::render() method, which outputs slider values into unquoted HTML attributes. The vulnerability also exploits the fact that the clean_default() method only casts values to numeric types when they are empty or out of bounds, allowing malicious strings like \u00271 tabindex=0 autofocus onfocus=alert(1) x=\u0027 to pass validation through PHP\u0027s loose type comparison. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into their user profile that will execute whenever an Administrator navigates to view the attacker\u0027s profile page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T09:27:08.744Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/31c554cf-eee9-45a8-8fb6-198978620204?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/fields/slider/class-redux-slider.php#L311"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/fields/slider/class-redux-slider.php#L311"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/extensions/users/class-redux-extension-users.php#L1018"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/extensions/users/class-redux-extension-users.php#L1018"
},
{
"url": "https://github.com/reduxframework/redux-framework/pull/4112/changes"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-02T06:49:25.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-09T21:20:33.000Z",
"value": "Disclosed"
}
],
"title": "Redux Framework \u003c= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-5399",
"datePublished": "2026-09-10T09:27:08.744Z",
"dateReserved": "2026-04-02T06:19:06.082Z",
"dateUpdated": "2026-09-10T12:55:57.736Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10795 (GCVE-0-2026-10795)
Vulnerability from cvelistv5 – Published: 2026-06-11 05:34 – Updated: 2026-06-11 14:37Title
UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc
Summary
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-11 14:37 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | UpdraftPlus: WP Backup & Migration Plugin |
Affected:
0 , ≤ 1.26.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10795",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-11T14:37:25.695215Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-11T14:37:38.538Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UpdraftPlus: WP Backup \u0026 Migration Plugin",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "1.26.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "XU WEI TING"
}
],
"descriptions": [
{
"lang": "en",
"value": "The UpdraftPlus: WP Backup \u0026 Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-11T05:34:20.360Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e901c2a0-2477-4b9a-8483-6002419e0a2f?source=cve"
},
{
"url": "https://plugins.svn.wordpress.org/updraftplus/tags/1.26.4/vendor/team-updraft/common-libs/src/updraft-rpc/class-udrpc2.php"
},
{
"url": "https://plugins.svn.wordpress.org/updraftplus/tags/1.26.4/vendor/team-updraft/common-libs/src/updraft-rpc/class-udrpc.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3561938/updraftplus/trunk/vendor/team-updraft/common-libs/src/updraft-rpc/class-udrpc2.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-03T21:23:51.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-06-10T16:41:29.000Z",
"value": "Disclosed"
}
],
"title": "UpdraftPlus: WP Backup \u0026 Migration Plugin \u003c= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-10795",
"datePublished": "2026-06-11T05:34:20.360Z",
"dateReserved": "2026-06-03T21:07:44.434Z",
"dateUpdated": "2026-06-11T14:37:38.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8438 (GCVE-0-2026-8438)
Vulnerability from cvelistv5 – Published: 2026-06-06 01:26 – Updated: 2026-06-06 11:44
VLAI
EPSS
VEX
Title
All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path
Summary
The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the get_rest_route() function and missing output escaping in the column_default() method of the debug log list table. When the 'Disable REST API for non-logged in users' feature (aiowps_disallow_unauthorized_rest_requests) is enabled alongside debug logging (aiowps_enable_debug), an unauthenticated attacker can embed arbitrary HTML or JavaScript in the REST request path. The path is retrieved via urldecode($_SERVER['REQUEST_URI']), which decodes URL-encoded payloads into literal HTML characters. This decoded, unsanitized value is concatenated directly into a debug log message and stored in the database. When an administrator navigates to the AIOS Dashboard Debug Logs page, the column_default() method returns the raw database value without escaping, and the parent list table echoes it directly, causing JavaScript execution in the administrator's browser session. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the debug log page, enabling nonce theft, privileged AJAX/REST actions, and potential full site compromise.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-06 11:35 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | All-In-One Security (AIOS) – Security and Firewall |
Affected:
0 , ≤ 5.4.7
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8438",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-06T11:35:33.670566Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-06T11:44:40.204Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "All-In-One Security (AIOS) \u2013 Security and Firewall",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "5.4.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dmitrii Ignatyev"
}
],
"descriptions": [
{
"lang": "en",
"value": "The All-In-One Security (AIOS) \u2013 Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the get_rest_route() function and missing output escaping in the column_default() method of the debug log list table. When the \u0027Disable REST API for non-logged in users\u0027 feature (aiowps_disallow_unauthorized_rest_requests) is enabled alongside debug logging (aiowps_enable_debug), an unauthenticated attacker can embed arbitrary HTML or JavaScript in the REST request path. The path is retrieved via urldecode($_SERVER[\u0027REQUEST_URI\u0027]), which decodes URL-encoded payloads into literal HTML characters. This decoded, unsanitized value is concatenated directly into a debug log message and stored in the database. When an administrator navigates to the AIOS Dashboard Debug Logs page, the column_default() method returns the raw database value without escaping, and the parent list table echoes it directly, causing JavaScript execution in the administrator\u0027s browser session. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the debug log page, enabling nonce theft, privileged AJAX/REST actions, and potential full site compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-06T01:26:10.529Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b7ed73-a654-40ef-8d80-6171393da8e7?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/admin/wp-security-list-debug.php#L43"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/admin/wp-security-list-debug.php#L43"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-utility.php#L1547"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-utility.php#L1547"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-general-init-tasks.php#L887"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-general-init-tasks.php#L887"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-debug-logger.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-debug-logger.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3558989/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-12T19:06:11.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-06-05T11:51:22.000Z",
"value": "Disclosed"
}
],
"title": "All-In-One Security (AIOS) \u003c= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-8438",
"datePublished": "2026-06-06T01:26:10.529Z",
"dateReserved": "2026-05-12T18:50:59.037Z",
"dateUpdated": "2026-06-06T11:44:40.204Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7660 (GCVE-0-2026-7660)
Vulnerability from cvelistv5 – Published: 2026-05-28 06:45 – Updated: 2026-05-28 10:33
VLAI
EPSS
VEX
Title
Easy Updates Manager <= 9.0.20 - Reflected Cross-Site Scripting via 'paged' Parameter
Summary
The Easy Updates Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in versions up to, and including, 9.0.20 This is due to insufficient input sanitization and output escaping in the pagination() function. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page granted they can trick an administrator into performing an action such as clicking on a link.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-28 10:26 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | Easy Updates Manager |
Affected:
0 , ≤ 9.0.20
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7660",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-28T10:26:58.298078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-28T10:33:53.918Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Easy Updates Manager",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "9.0.20",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dmitrii Ignatyev"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Easy Updates Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027paged\u0027 parameter in versions up to, and including, 9.0.20 This is due to insufficient input sanitization and output escaping in the pagination() function. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page granted they can trick an administrator into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-28T06:45:42.024Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bbbd989c-4d69-45c9-bcb9-44f9ab98b969?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/stops-core-theme-and-plugin-updates/trunk/includes/MPSUM_List_Table.php#L800"
},
{
"url": "https://plugins.trac.wordpress.org/browser/stops-core-theme-and-plugin-updates/tags/9.0.20/includes/MPSUM_List_Table.php#L800"
},
{
"url": "https://plugins.trac.wordpress.org/browser/stops-core-theme-and-plugin-updates/trunk/includes/MPSUM_Plugins_List_Table.php#L55"
},
{
"url": "https://plugins.trac.wordpress.org/browser/stops-core-theme-and-plugin-updates/tags/9.0.20/includes/MPSUM_Plugins_List_Table.php#L55"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3531188/stops-core-theme-and-plugin-updates/trunk/includes/MPSUM_List_Table.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fstops-core-theme-and-plugin-updates/tags/9.0.20\u0026new_path=%2Fstops-core-theme-and-plugin-updates/tags/9.0.21"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-01T19:43:31.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-05-27T18:13:25.000Z",
"value": "Disclosed"
}
],
"title": "Easy Updates Manager \u003c= 9.0.20 - Reflected Cross-Site Scripting via \u0027paged\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-7660",
"datePublished": "2026-05-28T06:45:42.024Z",
"dateReserved": "2026-05-01T19:28:13.961Z",
"dateUpdated": "2026-05-28T10:33:53.918Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7252 (GCVE-0-2026-7252)
Vulnerability from cvelistv5 – Published: 2026-05-07 04:27 – Updated: 2026-05-07 14:15
VLAI
EPSS
VEX
Title
WP-Optimize <= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta
Summary
The WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in all versions up to, and including, 4.5.2 This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is possible because 'original-file' is a public (non-protected) meta key — it does not begin with an underscore — allowing Authors to freely create or modify it on their own attachment posts via the standard Edit Media form or the REST API.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-07 14:15 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance |
Affected:
0 , ≤ 4.5.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7252",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-07T14:15:17.661876Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-07T14:15:26.842Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP-Optimize \u2013 Cache, Compress images, Minify \u0026 Clean database to boost page speed \u0026 performance",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ly Hoang"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP-Optimize \u2013 Cache, Compress images, Minify \u0026 Clean database to boost page speed \u0026 performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in all versions up to, and including, 4.5.2 This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is possible because \u0027original-file\u0027 is a public (non-protected) meta key \u2014 it does not begin with an underscore \u2014 allowing Authors to freely create or modify it on their own attachment posts via the standard Edit Media form or the REST API."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-07T04:27:10.902Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cc815ef2-dd02-4faa-b202-dd1552f889db?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/trunk/includes/class-updraft-smush-manager.php#L1649"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/tags/4.5.2/includes/class-updraft-smush-manager.php#L1649"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/trunk/includes/class-updraft-smush-manager.php#L1645"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/tags/4.5.2/includes/class-updraft-smush-manager.php#L1645"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/trunk/includes/class-updraft-smush-manager.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/tags/4.5.2/includes/class-updraft-smush-manager.php#L81"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3518513/wp-optimize/trunk/includes/class-updraft-smush-manager.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-optimize/tags/4.5.2\u0026new_path=%2Fwp-optimize/tags/4.5.3"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-27T19:26:04.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-05-06T15:34:39.000Z",
"value": "Disclosed"
}
],
"title": "WP-Optimize \u003c= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via \u0027original-file\u0027 Post Meta"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-7252",
"datePublished": "2026-05-07T04:27:10.902Z",
"dateReserved": "2026-04-27T19:09:53.550Z",
"dateUpdated": "2026-05-07T14:15:26.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-13362 (GCVE-0-2024-13362)
Vulnerability from cvelistv5 – Published: 2026-05-01 05:29 – Updated: 2026-05-01 13:23
VLAI
EPSS
VEX
Title
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Summary
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-01 13:23 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
24 references
Impacted products
131 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13362",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-01T13:23:14.835839Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-01T13:23:26.723Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Go Fetch Jobs (for WP Job Manager)",
"vendor": "sebet",
"versions": [
{
"lessThanOrEqual": "1.8.4.8.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dynamic Copyright Year",
"vendor": "5starplugins",
"versions": [
{
"lessThanOrEqual": "1.0.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Code Manager",
"vendor": "peterschulznl",
"versions": [
{
"lessThanOrEqual": "1.0.40",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Advanced Scrollbar \u2013 Custom Scrollbar Styling and Behavior",
"vendor": "bplugins",
"versions": [
{
"lessThanOrEqual": "1.1.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Goal Tracker \u2013 Custom Event Tracking for GA4",
"vendor": "yuvalo",
"versions": [
{
"lessThanOrEqual": "1.1.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent",
"vendor": "essekia",
"versions": [
{
"lessThanOrEqual": "1.1.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Page Templates",
"vendor": "josevega",
"versions": [
{
"lessThanOrEqual": "1.1.16",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Payment Gateway for ACBA BANK",
"vendor": "hkdigitalagency",
"versions": [
{
"lessThanOrEqual": "1.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Dracula Dark Mode \u2013 Accessibility, Reading Mode \u0026 Dark Mode for WordPress",
"vendor": "princeahmed",
"versions": [
{
"lessThanOrEqual": "1.2.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Forumax \u2013 AI Powered Advanced Community Forum Plugin",
"vendor": "spiderdevs",
"versions": [
{
"lessThanOrEqual": "1.2.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Five-Star Ratings Shortcode",
"vendor": "seezee",
"versions": [
{
"lessThanOrEqual": "1.2.56",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Product Layouts for WooCommerce",
"vendor": "oxilab",
"versions": [
{
"lessThanOrEqual": "1.3.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Meta Field Block \u2013 Display custom fields in the Block Editor without coding",
"vendor": "mr2p",
"versions": [
{
"lessThanOrEqual": "1.3.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Custom WooCommerce Checkout Fields Editor",
"vendor": "themelocation",
"versions": [
{
"lessThanOrEqual": "1.3.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Open User Map",
"vendor": "100plugins",
"versions": [
{
"lessThanOrEqual": "1.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Notification Bell",
"vendor": "wpdever",
"versions": [
{
"lessThanOrEqual": "1.4.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Remove Add to Cart WooCommerce",
"vendor": "themelocation",
"versions": [
{
"lessThanOrEqual": "1.4.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "File Manager for Google Drive \u2013 Integrate Google Drive",
"vendor": "princeahmed",
"versions": [
{
"lessThanOrEqual": "1.4.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Marijuana Age Verify",
"vendor": "5starplugins",
"versions": [
{
"lessThanOrEqual": "1.5.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RevivePress \u2013 Keep your Old Content Evergreen",
"vendor": "infosatech",
"versions": [
{
"lessThanOrEqual": "1.5.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Restaurant \u0026 Cafe Addon for Elementor",
"vendor": "nicheaddons",
"versions": [
{
"lessThanOrEqual": "1.5.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Send Users Email \u2013 Email Subscribers, Email Marketing Newsletter",
"vendor": "paretodigital",
"versions": [
{
"lessThanOrEqual": "1.5.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Unlimited Elements For Elementor",
"vendor": "unitecms",
"versions": [
{
"lessThanOrEqual": "1.5.140",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Role Based Pricing for Woo by Meow Crew",
"vendor": "meowcrew",
"versions": [
{
"lessThanOrEqual": "1.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Primary Addon for Elementor",
"vendor": "nicheaddons",
"versions": [
{
"lessThanOrEqual": "1.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Featured Images in RSS for Mailchimp \u0026 More",
"vendor": "5starplugins",
"versions": [
{
"lessThanOrEqual": "1.6.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Image Alt Text Manager \u2013 Bulk \u0026 Dynamic Alt Tags For image SEO Optimization + AI",
"vendor": "wpsaad",
"versions": [
{
"lessThanOrEqual": "1.6.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Message Filter for Contact Form 7",
"vendor": "kofimokome",
"versions": [
{
"lessThanOrEqual": "1.6.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Embedder for Google Reviews",
"vendor": "paretodigital",
"versions": [
{
"lessThanOrEqual": "1.6.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MapGeo \u2013 Interactive Geo Maps",
"vendor": "interactivegeomaps",
"versions": [
{
"lessThanOrEqual": "1.6.22",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WPBITS Addons For Elementor Page Builder",
"vendor": "wpbits",
"versions": [
{
"lessThanOrEqual": "1.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Widgets on Pages",
"vendor": "toddhalfpenny",
"versions": [
{
"lessThanOrEqual": "1.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Spotlight Social Feeds \u2013 Block, Shortcode, and Widget",
"vendor": "rebelcode",
"versions": [
{
"lessThanOrEqual": "1.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WOW Styler for CF7 \u2013 Visual Styler for Contact Form 7 Forms",
"vendor": "tobias_conrad",
"versions": [
{
"lessThanOrEqual": "1.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AI Bud \u2013 AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o",
"vendor": "webfactory",
"versions": [
{
"lessThanOrEqual": "1.7.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Text To Speech TTS Accessibility",
"vendor": "hasanazizul",
"versions": [
{
"lessThanOrEqual": "1.7.34",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Easy Age Verify",
"vendor": "5starplugins",
"versions": [
{
"lessThanOrEqual": "1.8.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AI Puffer \u2013 Chat. Create. Automate. (formerly AI Power)",
"vendor": "senols",
"versions": [
{
"lessThanOrEqual": "1.8.99",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Justified Gallery",
"vendor": "damian-gora",
"versions": [
{
"lessThanOrEqual": "1.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mapster WP Maps",
"vendor": "mapster",
"versions": [
{
"lessThanOrEqual": "1.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "StreamWeasels Twitch Integration",
"vendor": "streamweasels",
"versions": [
{
"lessThanOrEqual": "1.9.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XT Variation Swatches for WooCommerce",
"vendor": "xplodedthemes",
"versions": [
{
"lessThanOrEqual": "1.9.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "bBlocks \u2013 Essential Gutenberg Blocks \u0026 Patterns Collection",
"vendor": "bplugins",
"versions": [
{
"lessThanOrEqual": "1.9.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "URL Shortify \u2013 Simple and Easy URL Shortener",
"vendor": "kaizencoders",
"versions": [
{
"lessThanOrEqual": "1.10.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Kikote \u2013 Location Picker at Checkout \u0026 Google Address AutoFill Plugin for WooCommerce",
"vendor": "uriahs-victor",
"versions": [
{
"lessThanOrEqual": "1.10.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Geo Mashup",
"vendor": "cyberhobo",
"versions": [
{
"lessThanOrEqual": "1.13.15",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Disable Payment Methods based on cart conditions for WooCommerce",
"vendor": "josevega",
"versions": [
{
"lessThanOrEqual": "1.16.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Automatic Internal Links for SEO by Pagup",
"vendor": "pagup",
"versions": [
{
"lessThanOrEqual": "2.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Full Screen Background",
"vendor": "enweby",
"versions": [
{
"lessThanOrEqual": "2.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Master Addons For Elementor \u2013 Widgets, Extensions, Theme Builder, Popup Builder \u0026 Template Kits",
"vendor": "litonice13",
"versions": [
{
"lessThanOrEqual": "2.0.7.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player",
"vendor": "princeahmed",
"versions": [
{
"lessThanOrEqual": "2.0.82",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Carousel, Recent Post Slider and Banner Slider",
"vendor": "spicethemes",
"versions": [
{
"lessThanOrEqual": "2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)",
"vendor": "pagup",
"versions": [
{
"lessThanOrEqual": "2.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XT Quick View for WooCommerce",
"vendor": "xplodedthemes",
"versions": [
{
"lessThanOrEqual": "2.1.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Smart phone field for Gravity Forms",
"vendor": "pluginscafe",
"versions": [
{
"lessThanOrEqual": "2.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Notification Bar, Announcement and Cookie Notice WordPress Plugin \u2013 FooBar",
"vendor": "fooplugins",
"versions": [
{
"lessThanOrEqual": "2.1.34",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PDF Poster \u2013 Display PDF Files with Custom Viewer",
"vendor": "bplugins",
"versions": [
{
"lessThanOrEqual": "2.2.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Events Addon for Elementor",
"vendor": "nicheaddons",
"versions": [
{
"lessThanOrEqual": "2.2.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HTML5 Audio Player \u2013 The Ultimate No-Code Podcast, MP3 \u0026 Audio Player",
"vendor": "bplugins",
"versions": [
{
"lessThanOrEqual": "2.2.27",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Glossary",
"vendor": "mte90",
"versions": [
{
"lessThanOrEqual": "2.2.38",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Restrict \u2013 membership, site, content and user access restrictions for WordPress",
"vendor": "tickera",
"versions": [
{
"lessThanOrEqual": "2.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Custom PHP Settings",
"vendor": "cyclonecode",
"versions": [
{
"lessThanOrEqual": "2.3.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Meta and Date Remover",
"vendor": "prasadkirpekar",
"versions": [
{
"lessThanOrEqual": "2.3.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Anti-Spam Protection \u2013 No API Key, GDPR Friendly",
"vendor": "fullworks",
"versions": [
{
"lessThanOrEqual": "2.3.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Premmerce Permalink Manager for WooCommerce",
"vendor": "premmerce",
"versions": [
{
"lessThanOrEqual": "2.3.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Music Player for Elementor \u2013 Audio Player \u0026 Podcast Player",
"vendor": "smartwpress",
"versions": [
{
"lessThanOrEqual": "2.4.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TopNewsWp \u2013 Display Tikcer News, RSS Feed Widget and Many More",
"vendor": "mhmrajib",
"versions": [
{
"lessThanOrEqual": "2.4.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Ocean Extra",
"vendor": "oceanwp",
"versions": [
{
"lessThanOrEqual": "2.4.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Gallery by FooGallery",
"vendor": "fooplugins",
"versions": [
{
"lessThanOrEqual": "2.4.27",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Automatic YouTube Gallery",
"vendor": "plugins360",
"versions": [
{
"lessThanOrEqual": "2.5.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EazyDocs \u2013 AI Powered Knowledge Base, Wiki, Documentation \u0026 FAQ Builder",
"vendor": "spiderdevs",
"versions": [
{
"lessThanOrEqual": "2.5.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Team Members \u2013 A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More",
"vendor": "samdani",
"versions": [
{
"lessThanOrEqual": "2.5.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Radio Station by netmix\u00ae \u2013 Manage and play your Show Schedule in WordPress!",
"vendor": "tonyzeoli",
"versions": [
{
"lessThanOrEqual": "2.5.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "StoreCustomizer \u2013 A plugin to Customize all WooCommerce Pages",
"vendor": "kaira",
"versions": [
{
"lessThanOrEqual": "2.5.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Joli Table Of Contents",
"vendor": "wpjoli",
"versions": [
{
"lessThanOrEqual": "2.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "GA4WP \u2013 Analytics Dashboard for the Website",
"vendor": "passionatebrains",
"versions": [
{
"lessThanOrEqual": "2.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Place Order Without Payment for WooCommerce",
"vendor": "nitin247",
"versions": [
{
"lessThanOrEqual": "2.6.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Better Messages \u2013 Live Chat, Chat Rooms, Real-Time Messaging \u0026 Private Messages",
"vendor": "wordplus",
"versions": [
{
"lessThanOrEqual": "2.6.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Share This Image",
"vendor": "mihail-barinov",
"versions": [
{
"lessThanOrEqual": "2.07",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Inavii Social Feed",
"vendor": "inavii",
"versions": [
{
"lessThanOrEqual": "2.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Lightbox \u0026 Modal Popup WordPress Plugin \u2013 FooBox",
"vendor": "fooplugins",
"versions": [
{
"lessThanOrEqual": "2.7.33",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XT Floating Cart for WooCommerce",
"vendor": "xplodedthemes",
"versions": [
{
"lessThanOrEqual": "2.8.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Mobile Menu \u2013 The Mobile-Friendly Responsive Menu",
"vendor": "takanakui",
"versions": [
{
"lessThanOrEqual": "2.8.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading \u0026 Image Optimization",
"vendor": "passionatebrains",
"versions": [
{
"lessThanOrEqual": "2.9.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Independent Analytics",
"vendor": "bensibley",
"versions": [
{
"lessThanOrEqual": "2.9.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Knowledge Base documentation \u0026 wiki plugin \u2013 BasePress Docs",
"vendor": "codesavory",
"versions": [
{
"lessThanOrEqual": "2.16.3.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Internal Link Juicer: SEO Auto Linker for WordPress",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "2.24.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Bulk Edit Posts and Products in Spreadsheet",
"vendor": "josevega",
"versions": [
{
"lessThanOrEqual": "2.25.16",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App",
"vendor": "saadiqbal",
"versions": [
{
"lessThanOrEqual": "3.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TablePress \u2013 Tables in WordPress made easy",
"vendor": "tobiasbg",
"versions": [
{
"lessThanOrEqual": "3.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Ultimeter",
"vendor": "bouncingsprout",
"versions": [
{
"lessThanOrEqual": "3.0.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TreePress \u2013 Easy Family Trees \u0026 Ancestor Profiles",
"vendor": "blackandwhitedigital",
"versions": [
{
"lessThanOrEqual": "3.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Pay For Post with WooCommerce",
"vendor": "mattpramschufer",
"versions": [
{
"lessThanOrEqual": "3.1.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Post to Google My Business (Google Business Profile)",
"vendor": "koen12344",
"versions": [
{
"lessThanOrEqual": "3.1.28",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Coupons and Deals \u2013 Coupon Plugin For Affiliate Marketers",
"vendor": "imtiazrayhan",
"versions": [
{
"lessThanOrEqual": "3.2.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Advanced Classifieds \u0026 Directory Pro",
"vendor": "pluginsware",
"versions": [
{
"lessThanOrEqual": "3.2.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Mixed Media Gallery Blocks",
"vendor": "gallerycreator",
"versions": [
{
"lessThanOrEqual": "3.2.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "BlockSpare \u2014 News, Magazine and Blog Addons for (Gutenberg) Block Editor",
"vendor": "blockspare",
"versions": [
{
"lessThanOrEqual": "3.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AidWP \u2013 Donation \u0026 Payment Forms (Stripe Powered)",
"vendor": "mhmrajib",
"versions": [
{
"lessThanOrEqual": "3.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Logo Showcase \u2013 Responsive Logo Carousel, Logo Slider \u0026 Logo Grid",
"vendor": "infornweb",
"versions": [
{
"lessThanOrEqual": "3.2.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Post Slider and Post Carousel with Post Vertical Scrolling Widget \u2013 A Responsive Post Slider",
"vendor": "pluginandplay",
"versions": [
{
"lessThanOrEqual": "3.2.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Solid Testimonials \u2013 Testimonial Slider, Video Testimonials \u0026 Customer Reviews",
"vendor": "samdani",
"versions": [
{
"lessThanOrEqual": "3.2.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Team Members Showcase",
"vendor": "wpspeedo",
"versions": [
{
"lessThanOrEqual": "3.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EleSpare \u2013 News, Magazine and Blog Addons for Elementor",
"vendor": "elespare",
"versions": [
{
"lessThanOrEqual": "3.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Post List Designer \u2013 Category Post, Recent Post, Post List",
"vendor": "infornweb",
"versions": [
{
"lessThanOrEqual": "3.3.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Blog Designer Pack \u2013 Blog, Post Grid, Post Slider, Post Carousel, Category Post, News",
"vendor": "infornweb",
"versions": [
{
"lessThanOrEqual": "3.4.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "YASR \u2013 Yet Another Star Rating Plugin for WordPress",
"vendor": "dashlabsltd",
"versions": [
{
"lessThanOrEqual": "3.4.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WPIDE \u2013 File Manager \u0026 Code Editor",
"vendor": "xplodedthemes",
"versions": [
{
"lessThanOrEqual": "3.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Premmerce Product Filter for WooCommerce",
"vendor": "premmerce",
"versions": [
{
"lessThanOrEqual": "3.7.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors \u0026 Custom Avatars",
"vendor": "afthemes",
"versions": [
{
"lessThanOrEqual": "3.8.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Delete Posts automatically",
"vendor": "wpmagics",
"versions": [
{
"lessThanOrEqual": "3.9.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Menu Image, Icons made easy",
"vendor": "takanakui",
"versions": [
{
"lessThanOrEqual": "3.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AWCA \u2013 The Great Analytics Insights for Your eStore",
"vendor": "passionatebrains",
"versions": [
{
"lessThanOrEqual": "3.12.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Announcement \u0026 Notification Banner \u2013 Bulletin",
"vendor": "mikewire_rocksolid",
"versions": [
{
"lessThanOrEqual": "3.12.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Thank You Page for WooCommerce",
"vendor": "nitin247",
"versions": [
{
"lessThanOrEqual": "4.2.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Contact Form 7 Multi-Step Forms",
"vendor": "webheadllc",
"versions": [
{
"lessThanOrEqual": "4.4.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Auto-Install Free SSL \u2013 Generate \u0026 Install Free SSL Certificates",
"vendor": "speedify",
"versions": [
{
"lessThanOrEqual": "4.5.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Books Gallery \u2013 Build Stunning Book Showcases \u0026 Libraries in Minutes",
"vendor": "mhmrajib",
"versions": [
{
"lessThanOrEqual": "4.6.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Easy Appointment Booking \u0026 Scheduling System \u2013 Webba Booking Calendar",
"vendor": "webba-agency",
"versions": [
{
"lessThanOrEqual": "5.0.57",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP fail2ban \u2013 Advanced Security",
"vendor": "invisnet",
"versions": [
{
"lessThanOrEqual": "5.3.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Ivory Search \u2013 WordPress Search Plugin",
"vendor": "vinod-dalvi",
"versions": [
{
"lessThanOrEqual": "5.5.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Data Access \u2013 App Builder for Tables, Forms, Charts, Maps \u0026 Dashboards",
"vendor": "peterschulznl",
"versions": [
{
"lessThanOrEqual": "5.5.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce",
"vendor": "elliotvs",
"versions": [
{
"lessThanOrEqual": "5.17.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Security Ninja \u2013 WordPress Security \u0026 Firewall",
"vendor": "cleverplugins",
"versions": [
{
"lessThanOrEqual": "5.222",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Checkout with Cash App on WooCommerce",
"vendor": "theafricanboss",
"versions": [
{
"lessThanOrEqual": "6.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Display Eventbrite Events",
"vendor": "fullworks",
"versions": [
{
"lessThanOrEqual": "6.1.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins",
"vendor": "mohsinoffline",
"versions": [
{
"lessThanOrEqual": "6.1.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Easy Social Feed \u2013 Social Photos Gallery and Post Feed for WordPress",
"vendor": "sjaved",
"versions": [
{
"lessThanOrEqual": "6.6.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate",
"vendor": "gn_themes",
"versions": [
{
"lessThanOrEqual": "7.3.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Encryption \u2013 One Click Free SSL Certificate \u0026 SSL / HTTPS Redirect, Security \u0026 SSL Scan",
"vendor": "gowebsmarty",
"versions": [
{
"lessThanOrEqual": "7.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto",
"vendor": "tripetto",
"versions": [
{
"lessThanOrEqual": "8.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Asaf Mozes"
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-01T05:29:54.148Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/tablepress/trunk/libraries/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/widgets-on-pages/trunk/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/menu-image/trunk/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.7.33/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/featured-images-for-rss-feeds/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpide/tags/3.5.0/dist/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/add-search-to-menu/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/master-addons/trunk/lib/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.27/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ocean-extra/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/internal-links/trunk/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/interactive-geo-maps/tags/1.6.21/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/independent-analytics/trunk/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/spotlight-social-photo-feeds/trunk/ui/freemius-pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woo-permalink-manager/tags/2.3.11/assets/admin/js/pricing-page/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pdf-poster/trunk/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-meta-and-date-remover/tags/2.3.4/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/freemius/assets/js/pricing/freemius-pricing.js"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3235286/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3249130/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3229060/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-30T17:32:32.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-04-30T17:17:30.000Z",
"value": "Disclosed"
}
],
"title": "Freemius \u003c= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-13362",
"datePublished": "2026-05-01T05:29:54.148Z",
"dateReserved": "2025-01-13T18:08:47.439Z",
"dateUpdated": "2026-05-01T13:23:26.723Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2712 (GCVE-0-2026-2712)
Vulnerability from cvelistv5 – Published: 2026-04-10 01:24 – Updated: 2026-04-10 13:46
VLAI
EPSS
VEX
Title
WP-Optimize <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation
Summary
The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the `receive_heartbeat()` function in `includes/class-wp-optimize-heartbeat.php` in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly invoking `Updraft_Smush_Manager_Commands` methods without verifying user capabilities, nonce tokens, or the allowed commands whitelist that the normal AJAX handler (`updraft_smush_ajax`) enforces. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke admin-only Smush operations including reading log files (`get_smush_logs`), deleting all backup images (`clean_all_backup_images`), triggering bulk image processing (`process_bulk_smush`), and modifying Smush options (`update_smush_options`).
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-10 13:46 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance |
Affected:
0 , ≤ 4.5.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2712",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-10T13:46:09.364998Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T13:46:16.718Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP-Optimize \u2013 Cache, Compress images, Minify \u0026 Clean database to boost page speed \u0026 performance",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dmitrii Ignatyev"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the `receive_heartbeat()` function in `includes/class-wp-optimize-heartbeat.php` in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly invoking `Updraft_Smush_Manager_Commands` methods without verifying user capabilities, nonce tokens, or the allowed commands whitelist that the normal AJAX handler (`updraft_smush_ajax`) enforces. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke admin-only Smush operations including reading log files (`get_smush_logs`), deleting all backup images (`clean_all_backup_images`), triggering bulk image processing (`process_bulk_smush`), and modifying Smush options (`update_smush_options`)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T01:24:57.952Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6a0a376e-ea3a-40ca-9341-f28f92e15e02?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/tags/4.4.1/includes/class-wp-optimize-heartbeat.php#L65"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/trunk/includes/class-wp-optimize-heartbeat.php#L65"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-optimize/tags/4.4.1/includes/class-wp-optimize-heartbeat.php#L82"
},
{
"url": "https://research.cleantalk.org/cve-2026-2712/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-03T12:42:09.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-04-09T11:52:37.000Z",
"value": "Disclosed"
}
],
"title": "WP-Optimize \u003c= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-2712",
"datePublished": "2026-04-10T01:24:57.952Z",
"dateReserved": "2026-02-18T20:31:43.704Z",
"dateUpdated": "2026-04-10T13:46:16.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-9488 (GCVE-0-2025-9488)
Vulnerability from cvelistv5 – Published: 2025-12-13 04:31 – Updated: 2026-04-08 17:23
VLAI
EPSS
VEX
Title
Redux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter
Summary
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 4.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-15 15:43 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | Redux Framework |
Affected:
0 , ≤ 4.5.8
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9488",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-15T15:43:04.148093Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-15T15:46:53.451Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Redux Framework",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "4.5.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Muhammad Yudha - DJ"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018data\u2019 parameter in all versions up to, and including, 4.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:23:21.320Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cabf776d-8749-45a8-94c1-7d1eef93a183?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.7/redux-core/inc/extensions/shortcodes/class-redux-shortcodes.php#L205"
},
{
"url": "https://wordpress.org/plugins/redux-framework/#developers"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3402803%40redux-framework\u0026new=3402803%40redux-framework\u0026sfp_email=\u0026sfph_mail=#file22"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-11-19T16:55:59.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2025-12-12T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Redux Framework \u003c= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-9488",
"datePublished": "2025-12-13T04:31:33.327Z",
"dateReserved": "2025-08-26T12:49:36.739Z",
"dateUpdated": "2026-04-08T17:23:21.320Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-13857 (GCVE-0-2024-13857)
Vulnerability from cvelistv5 – Published: 2025-03-07 09:21 – Updated: 2026-04-08 17:23
VLAI
EPSS
VEX
Title
WPGet API <= 2.2.10 - Authenticated (Administrator+) Server-Side Request Forgery
Summary
The WPGet API – Connect to any external REST API plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-07 13:35 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | WPGet API – Connect to any external REST API |
Affected:
0 , ≤ 2.2.10
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13857",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-07T13:35:50.583158Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-07T13:36:06.585Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPGet API \u2013 Connect to any external REST API",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "2.2.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Francesco Carlucci"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPGet API \u2013 Connect to any external REST API plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:23:59.917Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cd2a8e7b-6fca-49f3-ba6d-bdaa418f611a?source=cve"
},
{
"url": "https://wordpress.org/plugins/wpgetapi/#developers"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3251647/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-03-06T20:56:52.000Z",
"value": "Disclosed"
}
],
"title": "WPGet API \u003c= 2.2.10 - Authenticated (Administrator+) Server-Side Request Forgery"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-13857",
"datePublished": "2025-03-07T09:21:14.921Z",
"dateReserved": "2025-02-10T22:55:29.229Z",
"dateUpdated": "2026-04-08T17:23:59.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-0215 (GCVE-0-2025-0215)
Vulnerability from cvelistv5 – Published: 2025-01-15 22:23 – Updated: 2026-04-08 17:15
VLAI
EPSS
VEX
Title
UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scripting
Summary
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the showdata and initiate_restore parameters in all versions up to, and including, 1.24.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-16 14:22 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | UpdraftPlus: WP Backup & Migration Plugin |
Affected:
0 , ≤ 1.24.12
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0215",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-16T14:22:40.334371Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-16T18:43:27.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UpdraftPlus: WP Backup \u0026 Migration Plugin",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "1.24.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Asaf Mozes"
}
],
"descriptions": [
{
"lang": "en",
"value": "The UpdraftPlus: WP Backup \u0026 Migration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the showdata and initiate_restore parameters in all versions up to, and including, 1.24.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:15:33.397Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/af568eea-59ce-467e-ba03-625d04d3db6e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/updraftplus/tags/1.24.12/includes/updraft-admin-common.js#L4404"
},
{
"url": "https://plugins.trac.wordpress.org/browser/updraftplus/tags/1.24.12/includes/updraft-admin-common.js#L4439"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-12-25T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2025-01-15T09:43:13.000Z",
"value": "Disclosed"
}
],
"title": "UpdraftPlus - Backup/Restore \u003c= 1.24.12 - Reflected Cross-Site Scripting"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-0215",
"datePublished": "2025-01-15T22:23:32.852Z",
"dateReserved": "2025-01-03T19:31:41.889Z",
"dateUpdated": "2026-04-08T17:15:33.397Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-10957 (GCVE-0-2024-10957)
Vulnerability from cvelistv5 – Published: 2025-01-04 13:41 – Updated: 2025-01-06 16:37
VLAI
EPSS
VEX
Title
UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection
Summary
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserialization of untrusted input in the 'recursive_unserialized_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. An administrator must perform a search and replace action to trigger the exploit.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-06 16:18 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| davidanderson | UpdraftPlus: WP Backup & Migration Plugin |
Affected:
1.23.8 , ≤ 1.24.11
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10957",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-06T16:18:42.953815Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-06T16:26:51.896Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UpdraftPlus: WP Backup \u0026 Migration Plugin",
"vendor": "davidanderson",
"versions": [
{
"lessThanOrEqual": "1.24.11",
"status": "affected",
"version": "1.23.8",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Craig Smith"
}
],
"descriptions": [
{
"lang": "en",
"value": "The UpdraftPlus: WP Backup \u0026 Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserialization of untrusted input in the \u0027recursive_unserialized_replace\u0027 function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. An administrator must perform a search and replace action to trigger the exploit."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-06T16:37:04.468Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4729ed37-96b2-4717-8a72-89b9a21ec058?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/updraftplus/trunk/includes/class-search-replace.php#L411"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3212299/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-01-03T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "UpdraftPlus: WP Backup \u0026 Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-10957",
"datePublished": "2025-01-04T13:41:07.531Z",
"dateReserved": "2024-11-06T23:03:29.760Z",
"dateUpdated": "2025-01-06T16:37:04.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}