Read the docs

mitchelllevy

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

mitchelllevy records in CISA KEV

No mitchelllevy vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Ahathat 2 records HIGH

Records

4 records

TI-2024-10439 CVE-2024-11269 · GHSA-7h9p-m872-c67m

AHAthat Plugin <= 1.6 - Admin+ SQL Injection

Priority HIGH 67

The AHAthat Plugin WordPress plugin through 1.6 does not sanitize and escape a parameter before using it in a SQL statement, allowing Admin to perform SQL injection attacks.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00586 Published 2025-05-15 No fix listed CWE-89
TI-2024-11687 CVE-2024-12595 · GHSA-6gg3-5p97-3cp8

AHAthat Plugin <= 1.6 - Reflected XSS via REQUEST_URI

Priority MEDIUM 55

The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00328 Published 2025-01-02 No fix listed CWE-79
TI-2025-02182 CVE-2025-2511 · GHSA-v433-frww-q6q8

AHAthat Plugin <= 1.6 - Authenticated (Administrator+) SQL Injection via id Parameter

Priority LOW 22

The AHAthat Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.6 due to insufficient escaping on the user supplied parameter and lack of s…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00355 Published 2025-03-19 No fix listed CWE-89
Open these records in search →