Read the docs

AmauriC

Records22All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9

Exploited now

AmauriC records in CISA KEV

No AmauriC vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Tarteaucitronjs 5 records LOW Wpmobile.app 5 records LOW Tarteaucitron.io 1 record MEDIUM

Records

22 records

TI-2025-04443 CVE-2025-4955 · GHSA-23mx-m43g-r4fh

tarteaucitron.io < 1.9.5 - Contributor+ Stored XSS

Priority MEDIUM 55

The tarteaucitron.io WordPress plugin before 1.9.5 uses query parameters from YouTube oEmbed URLs without sanitizing these parameters correctly, which could allow users with the contributor role and above to perform Stor…

CVSS 3.1MEDIUM 4.7 Network High privileges No interaction EPSS 0.00375 Published 2025-06-18 Fixed in 1.9.5 CWE-79
TI-2026-65941 CVE-2026-94541 · GHSA-qhj3-2w8c-62vm

WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter

Priority MEDIUM 49

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is author…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00494 Published 2026-10-02 No fix listed CWE-862
TI-2024-29522 CVE-2024-43933 · GHSA-xrf5-2fh4-5hqj

WordPress WPMobile.App plugin <= 11.48 - CSRF to Stored XSS vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja allows Stored XSS.This issue affects WPMobile.App: from n/a through <= 11.48.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.003 Published 2024-10-31 No fix listed CWE-79
TI-2026-67452 CVE-2026-103421 · GHSA-wh25-3f53-gw28

WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment

Priority LOW 24

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI (path segment after /android_json/search/)' parameter in all versions up to, and inclu…

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00221 Published 2026-10-03 No fix listed CWE-79
TI-2026-75499 CVE-2026-111713 · GHSA-rfp9-xrhw-w637

Cross-site scripting in tarteaucitron.js via data-url attribute

Priority LOW 22

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00171 Published 2026-10-16 Fixed in 1.37.0 CWE-79
TI-2026-75500 CVE-2026-111714 · GHSA-h33v-xq5w-v2mw

Regular expression denial of service in tarteaucitron.js cookie purge

Priority LOW 11

tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00218 Published 2026-10-16 Fixed in 1.37.0 CWE-1333
Open these records in search →