Vendors / indieweb Records 2 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 1
Exploited now indieweb records in CISA KEV No indieweb vulnerabilities are listed in CISA KEV.
Priority LOW 39
The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4.
CVSS 3.1 HIGH 8.8· Network · No auth · User interaction · EPSS 0.00212 · Published 2025-10-24 · No fix listed CWE-352
Priority LOW 28
The IndieWeb plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Telephone' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping.
CVSS 3.1 MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00227 · Published 2026-01-09 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
0 1 1 0 0
