Read the docs

odude

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

odude records in CISA KEV

No odude vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Crypto Tool 3 records MEDIUM Flexi 1 record LOW User Post Gallery 1 record HIGH

Records

9 records

TI-2022-03725 CVE-2022-4060 · GHSA-g823-9xxv-px4q

User Post Gallery <= 2.19 - Unauthenticated RCE

Priority HIGH 82

The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.42723 Published 2023-01-16 No fix listed
TI-2024-09272 CVE-2024-9989 · GHSA-hmfh-w3mx-w6j4

Crypto <= 2.18 - Authentication Bypass via log_in

Priority MEDIUM 59

The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.18.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07112 Published 2024-10-29 No fix listed CWE-288
TI-2024-09271 CVE-2024-9988 · GHSA-3xw3-m65r-4f37

Crypto <= 2.19 - Authentication Bypass via register

Priority MEDIUM 51

The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.19.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01102 Published 2024-10-29 No fix listed CWE-288
TI-2025-23654 CVE-2025-32589 · GHSA-9rpg-mqj8-44g5

WordPress Flexi – Guest Submit Plugin <= 4.28 - Local File Inclusion vulnerability

Priority LOW 39

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in odude Flexi – Guest Submit flexi allows PHP Local File Inclusion.This issue affects Flexi – Guest S…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01041 Published 2025-04-11 No fix listed CWE-98
TI-2022-00372 CVE-2022-0449 · GHSA-hgvr-3m27-2x5c

Flexi - Guest Submit < 4.20 - Reflected Cross-Site Scripting

Priority LOW 29

The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.008 Published 2022-03-14 Fixed in 4.20 CWE-79
TI-2025-08369 CVE-2025-9129 · GHSA-pqgg-4fqm-2fwc

Flexi <= 4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via flexi-form-tag Shortcode

Priority LOW 28

The Flexi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's flexi-form-tag shortcode in all versions up to, and including, 4.28 due to insufficient input sanitization and ou…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00247 Published 2025-10-03 No fix listed CWE-79
Open these records in search →