Read the docs

taskbuilder

Records17All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9

Exploited now

taskbuilder records in CISA KEV

No taskbuilder vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Taskbuilder 5 records HIGH

Records

5 records in Taskbuilder · all components

TI-2024-09124 CVE-2024-9831 · GHSA-qrqf-gfw2-2f89

Taskbuilder < 3.0.9 - Admin+ SQL Injection

Priority HIGH 67

The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00586 Published 2025-05-15 Fixed in 3.0.9 CWE-89
TI-2024-09121 CVE-2024-9828 · GHSA-97cw-cf8m-4xxc

Taskbuilder < 3.0.5 - Admin+ SQL Injection

Priority MEDIUM 52

The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it in a SQL statement, allowing high privilege users such as admin to perform SQL Injection attacks

CVSS 3.1MEDIUM 4.1 Network High privileges No interaction EPSS 0.00504 Published 2024-11-21 Fixed in 3.0.5 CWE-89
TI-2025-16598 CVE-2025-22716 · GHSA-rj76-j4fr-rh37

WordPress Taskbuilder Plugin <= 3.0.6 - SQL Injection vulnerability

Priority MEDIUM 44

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in taskbuilder Taskbuilder taskbuilder allows SQL Injection.This issue affects Taskbuilder: from n/a through <= 3.0.6.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00444 Published 2025-01-21 No fix listed CWE-89
TI-2024-11068 CVE-2024-11930 · GHSA-v26g-qqjw-5qgq

Cross-site scripting in Taskbuilder – Project Management & Task Management Tool With…

Priority LOW 28

The Taskbuilder – WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppm_tasks shortcode in all versions up to, and including, 3.0.6 due to insu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00321 Published 2025-01-04 No fix listed CWE-79
TI-2022-02896 CVE-2022-3137 · GHSA-mf4x-mpcx-4r8x

TaskBuilder < 1.0.8 - Subscriber+ Stored XSS via SVG file upload

Priority LOW 25

The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber) creating a task to perform Stored Cross-Site Scripting by att…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.006 Published 2022-10-10 Fixed in 1.0.8 CWE-79
Open these records in search →