Read the docs

pronamic

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

pronamic records in CISA KEV

No pronamic vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-13882 CVE-2026-16635 · GHSA-72h4-7f42-rjh6

Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field

Priority MEDIUM 41

The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the `maybe_update_user_role()` function passing an attacker-controlled Gravity Forms…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00577 Published 2026-08-01 No fix listed CWE-269
TI-2024-37210 CVE-2024-56240 · GHSA-52j9-24vf-xr95

WordPress Pronamic Google Maps plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pronamic Pronamic Google Maps pronamic-google-maps allows Stored XSS.This issue affects Pronamic Google Maps: from n/a…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00296 Published 2025-01-02 No fix listed CWE-79
TI-2025-08569 CVE-2025-9352 · GHSA-pwcg-c8g4-qgxx

Pronamic Google Maps <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 24

The Pronamic Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the description field in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00246 Published 2025-08-28 No fix listed CWE-79
Open these records in search →