Read the docs

Cm-wp

Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Cm-wp records in CISA KEV

No Cm-wp vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Social Slider Widget 3 records MEDIUM Auto Featured Image 2 records HIGH Clearfy 2 records MEDIUM Woody Code Snippets 2 records LOW Titan Anti-spam & Security 1 record LOW

Records

2 records in Auto Featured Image · all components

TI-2023-00452 CVE-2023-0477 · GHSA-xv6m-g863-2r99

Auto Featured Image < 3.9.16 - Author+ Arbitrary File Upload

Priority HIGH 73

The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01645 Published 2023-03-13 Fixed in 3.9.16 CWE-434
TI-2021-07211 CVE-2021-24932 · GHSA-9xfx-427g-vgqq

Auto Featured Image < 3.9.3 - Reflected Cross-Site Scripting

Priority LOW 29

The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.3 does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS block, leading to a Reflected Cross-Site…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00827 Published 2021-12-13 Fixed in 3.9.3 CWE-79
Open these records in search →