Read the docs

WP Experts

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

WP Experts records in CISA KEV

No WP Experts vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Protect Wp Admin 2 records MEDIUM Custom Share Buttons With Floating Sidebar 1 record LOW Wp-categories-widget 1 record LOW Wp Social Buttons 1 record LOW

Records

6 records

TI-2023-02941 CVE-2023-3139 · GHSA-xr6q-qcgj-7prg

Protect WP Admin < 4.0 - Unauthenticated Protection Bypass

Priority MEDIUM 60

The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00734 Published 2023-07-04 Fixed in 4.0 CWE-601
TI-2021-07186 CVE-2021-24906 · GHSA-vfmc-6gqf-r52m

Protect WP Admin < 3.6.2 - Unauthenticated Plugin Deactivation

Priority LOW 36

The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin (and therefore the protection offered)…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01489 Published 2022-01-24 Fixed in 3.6.2 CWE-862
TI-2024-12933 CVE-2024-13914 · GHSA-7chh-jrvc-3cqw

Path traversal in WP Experts File Manager Advanced Shortcode

Priority LOW 35

The File Manager Advanced Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.4 (file-manager-advanced-shortcode) and 2.5.6 (advanced-file-manager-pro-premium),…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00895 Published 2025-05-15 No fix listed CWE-22
TI-2022-01583 CVE-2022-1717 · GHSA-j4c9-5ppc-wh72

Custom Share Buttons with Floating Sidebar < 4.2 - Admin+ Stored XSS

Priority LOW 23

The Custom Share Buttons with Floating Sidebar WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting at…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00588 Published 2022-06-20 Fixed in 4.2 CWE-79
TI-2022-00779 CVE-2022-0874 · GHSA-w376-4pjj-5fm9

WP Social Buttons <= 2.1 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The WP Social Buttons WordPress plugin through 2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability i…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-05-09 No fix listed CWE-79
Open these records in search →