Read the docs

Weblizar

Records17All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

Weblizar records in CISA KEV

No Weblizar vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Pinterest-feeds 4 records LOW Admin Custom Login 2 records MEDIUM School Management 2 records HIGH Responsive Coming Soon & Maintenance Mode 1 record MEDIUM School Management - Education & Learning Management 1 record MEDIUM Social Likebox & Feed 1 record LOW

Records

17 records

TI-2022-01479 CVE-2022-1609 · GHSA-4g99-5gw9-42hv

The School Management < 9.9.7 - Unauthenticated RCE via REST api

Priority HIGH 84

The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.64075 Published 2024-01-16 Fixed in 9.9.7 CWE-94
TI-2022-23507 CVE-2022-47430 · GHSA-rvhc-5c8m-3qg8

WordPress The School Management – Education & Learning Management Plugin <= 4.1 is vulnerable to SQL Injection

Priority MEDIUM 50

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar The School Management – Education & Learning Management allows SQL Injection.This issue affects The School Ma…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00681 Published 2023-11-06 No fix listed CWE-89
TI-2022-23193 CVE-2022-46849 · GHSA-mpx8-qgg5-7wpm

WordPress Coming Soon Plugin <= 1.5.9 is vulnerable to SQL Injection

Priority MEDIUM 50

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar Coming Soon Page – Responsive Coming Soon & Maintenance Mode allows SQL Injection.This issue affects Coming S…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00681 Published 2023-11-06 No fix listed CWE-89
TI-2026-08559 CVE-2026-9767 · GHSA-mjq3-78vf-6gv2

The School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter

Priority LOW 30

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00551 Published 2026-08-16 No fix listed CWE-89
TI-2024-25990 CVE-2024-38756 · GHSA-32w5-785v-xx4q

Information disclosure in Weblizar Coming Soon

Priority LOW 30

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Weblizar Coming Soon allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coming Soon: from n/a through 1.6.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00364 Published 2024-08-13 No fix listed CWE-200
TI-2024-01730 CVE-2024-1858 · GHSA-hq4p-4fvf-wqvf

Lightbox slider – Responsive Lightbox Gallery <= 1.9.9 - Authenticated (Contributor+) PHP Object Injection

Priority LOW 25

The Lightbox slider – Responsive Lightbox Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.9 via deserialization of untrusted input through post meta data.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00531 Published 2024-03-29 No fix listed CWE-502
TI-2026-02114 CVE-2026-2487 · GHSA-jqwr-hf6q-qx2c

Cross-site scripting in Weblizar Admin Custom Login

Priority LOW 20

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00327 Published 2026-08-16 No fix listed CWE-79
Open these records in search →