GrandPlugins

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

GrandPlugins records in CISA KEV

No GrandPlugins vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Avif Uploader 1 record MEDIUM Woo Quick View And Buy Now 1 record LOW

Records

4 records

TI-2024-08574 CVE-2024-9238 · GHSA-7pq2-p2r6-3h8r

AVIF & SVG Uploader <= 1.1.0 - Author+ Stored XSS via SVG Uplaod

MEDIUM 58

The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00318 Published 2025-05-15 Fixed in 1.1.1 CWE-79

TI-2024-08411 CVE-2024-9060 · GHSA-9j74-wx54-mf4m

AVIF & SVG Uploader <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

LOW 29

The AVIF & SVG Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in version 1.1.0 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00387 Published 2024-10-01 No fix listed CWE-79

TI-2023-25797 CVE-2023-47657 · GHSA-pv48-92jp-7wjh

Cross-site scripting in GrandPlugins Direct Checkout – Quick View – Buy Now For…

LOW 27

Auth. (ShopManager+) Stored Cross-Site Scripting (XSS) vulnerability in GrandPlugins Direct Checkout – Quick View – Buy Now For WooCommerce plugin <= 1.5.8 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00394 Published 2023-11-13 No fix listed CWE-79

TI-2025-31888 CVE-2025-49973 · GHSA-xvw6-2phf-v6gr

Missing authorization in GrandPlugins Image Sizes Controller, Create Custom Image Sizes…

LOW 20

Missing Authorization vulnerability in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes image-sizes-controller allows Exploiting Incorrectly Configured Access Control Security Levels.Th…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00259 Published 2025-06-20 No fix listed CWE-862

Open these records in search →

Critical	0
High	0
Medium	4
Low	0
No CVSS	0