Read the docs

f1logic

Records11All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

f1logic records in CISA KEV

No f1logic vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Custom Field Manager 1 record MEDIUM Insert Php Code Snippet 1 record LOW

Records

11 records

TI-2024-11929 CVE-2024-12873 · GHSA-4x2h-w98x-4p25

Custom Field Manager <= 1.0 - Reflected XSS Vulnerability

Priority MEDIUM 60

The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00589 Published 2025-05-15 No fix listed CWE-79
TI-2020-18898 CVE-2020-36727 · GHSA-xj95-mhv8-mh4r

Newsletter Manager <= 1.5.1 - Insecure Deserialization

Priority MEDIUM 52

The Newsletter Manager plugin for WordPress is vulnerable to insecure deserialization in versions up to, and including, 1.5.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01615 Published 2023-06-07 No fix listed CWE-502
TI-2024-02132 CVE-2024-2295 · GHSA-6xph-25m2-x9mg

Contact Form Manager <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 28

The Contact Form Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [xyz-cfm-form] shortcode in all versions up to, and including, 1.6.1 due to insufficient input sanitization and…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00273 Published 2024-06-01 No fix listed CWE-79
TI-2025-11076 CVE-2025-12079 · GHSA-9rf6-24pm-gw73

WP Twitter Auto Publish <= 1.7.4 - Reflected Cross-Site Scripting via PostMessage

Priority LOW 27

The WP Twitter Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00266 Published 2025-11-18 No fix listed CWE-79
TI-2025-11074 CVE-2025-12077 · GHSA-7g7g-5gf7-vcxp

WP to LinkedIn Auto Publish <= 1.9.8 - Reflected Cross-Site Scripting via PostMessage

Priority LOW 27

The WP to LinkedIn Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00249 Published 2025-12-13 No fix listed CWE-79
TI-2025-11073 CVE-2025-12076 · GHSA-g67m-j5mf-fc3x

Social Media Auto Publish <= 3.6.5 - Reflected Cross-Site Scripting via PostMessage

Priority LOW 27

The Social Media Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage parameter in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output e…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0025 Published 2025-12-13 No fix listed CWE-79
TI-2025-11062 CVE-2025-12064 · GHSA-96cx-3fh6-vv56

WP2Social Auto Publish <= 2.4.7 - Reflected Cross-Site Scripting via PostMessage

Priority LOW 27

The WP2Social Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0022 Published 2025-11-08 No fix listed CWE-79
TI-2024-00608 CVE-2024-0658 · GHSA-2g72-wghv-7rm3

Insert PHP Code Snippet <= 1.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting

Priority LOW 22

The Insert PHP Code Snippet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user's name when accessing the insert-php-code-snippet-manage page in all versions up to, and including, 1.3.4 due to…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00337 Published 2024-02-20 No fix listed CWE-79
TI-2026-10379 CVE-2026-12042 · GHSA-5v5w-p5x3-68gq

WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter

Priority LOW 20

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00335 Published 2026-09-19 No fix listed CWE-79
TI-2025-39789 CVE-2025-64356 · GHSA-jvpv-fpvh-5mfh

WordPress Insert PHP Code Snippet plugin <= 1.4.3 - Broken Access Control vulnerability

Priority LOW 19

Missing Authorization vulnerability in f1logic Insert PHP Code Snippet insert-php-code-snippet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Insert PHP Code Snippet: from n/a…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0021 Published 2025-10-31 No fix listed CWE-862
Open these records in search →