epiphyt

Records6All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

epiphyt records in CISA KEV

No epiphyt vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Embed Privacy 2 records MEDIUM Form Block 1 record LOW

Records

6 records

TI-2023-26163 CVE-2023-48300

Embed Privacy missing escaping for show_all attribute in opt-out shortcode

MEDIUM 61

The `Embed Privacy` plugin for WordPress that prevents the loading of embedded external content is vulnerable to Stored Cross-Site Scripting via `embed_privacy_opt_out` shortcode in versions up to, and including, 1.8.0 d…

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00527 Published 2023-11-20 Fixed in 1.8.1 CWE-79

TI-2025-34456 CVE-2025-54693 · GHSA-3274-pvqm-8xhj

WordPress Form Block Plugin <= 1.5.5 - Arbitrary File Upload Vulnerability

MEDIUM 41

Unrestricted Upload of File with Dangerous Type vulnerability in epiphyt Form Block form-block allows Upload a Web Shell to a Web Server.This issue affects Form Block: from n/a through <= 1.5.5.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.00322 Published 2025-08-14 No fix listed CWE-434

TI-2026-68298 CVE-2026-104814 · GHSA-99hr-mrh8-j9g3

Cross-site scripting in WordPress Form Block plugin

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0023 Published 2026-10-06 No fix listed CWE-79

TI-2026-41283 CVE-2026-57346 · GHSA-f3vj-vpq8-wfhm

WordPress Embed Privacy plugin <= 1.12.3 - Arbitrary File Deletion vulnerability

LOW 31

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Epiphyt Embed Privacy allows Path Traversal.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00409 Published 2026-06-29 No fix listed CWE-22

TI-2023-28340 CVE-2023-51694 · GHSA-283m-jhf4-68hp

WordPress Embed Privacy Plugin <= 1.8.0 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Epiphyt Embed Privacy allows Stored XSS.This issue affects Embed Privacy: from n/a through 1.8.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00289 Published 2024-02-01 No fix listed CWE-79

TI-2023-14432 CVE-2023-30616

Cross Site Request Forgery due to missing nonce verification in form block

LOW 29

Form block is a wordpress plugin designed to make form creation easier.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00295 Published 2023-04-20 Fixed in 1.0.2 CWE-352

Open these records in search →

Critical	1
High	2
Medium	3
Low	0
No CVSS	0