Read the docs

shawfactor

Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

shawfactor records in CISA KEV

No shawfactor vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Lh-password-changer 1 record MEDIUM

Records

8 records

TI-2025-17314 CVE-2025-23547 · GHSA-wcwh-8v3h-qv4q

WordPress LH Login Page plugin <= 2.14 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 32

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shawfactor LH Login Page lh-login-page allows Reflected XSS.This issue affects LH Login Page: from n/a through <= 2.14…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00429 Published 2025-01-16 No fix listed CWE-79
TI-2025-21862 CVE-2025-30587 · GHSA-p753-73v7-m85r

WordPress LH OGP Meta plugin <= 1.73 - CSRF to Stored XSS Vulnerability

Priority LOW 30

Cross-Site Request Forgery (CSRF) vulnerability in shawfactor LH OGP Meta lh-ogp-meta-tags allows Stored XSS.This issue affects LH OGP Meta: from n/a through <= 1.73.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00182 Published 2025-03-24 No fix listed CWE-352
TI-2024-08556 CVE-2024-9220 · GHSA-fcff-4m68-vv98

LH Copy Media File <= 1.08 - Reflected Cross-Site Scripting

Priority LOW 27

The LH Copy Media File plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.08.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00392 Published 2024-10-01 No fix listed CWE-79
TI-2024-06565 CVE-2024-7090 · GHSA-jqcw-fvg5-7hmv

LH Add Media From Url <= 1.23 - Reflected Cross-Site Scripting

Priority LOW 27

The LH Add Media From Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘lh_add_media_from_url-file_url’ parameter in all versions up to, and including, 1.23 due to insufficient input sanit…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00412 Published 2024-08-21 No fix listed CWE-79
TI-2025-08826 CVE-2025-9633 · GHSA-x85q-6fq4-p9qp

LH Signing <= 2.83 - Cross-Site Request Forgery

Priority LOW 19

The LH Signing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.83.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00167 Published 2025-09-11 No fix listed CWE-352
Open these records in search →