Read the docs
TI-2015-08033 Aliases CVE-2015-10105GHSA-pj62-8px7-m9hh

IP Blacklist Cloud Plugin CSV File Import ip_blacklist_cloud.php valid_js_identifier path traversal

Priority HIGH 75CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability, which was classified as critical, was found in IP Blacklist Cloud Plugin up to 3.42 on WordPress. This affects the function valid_js_identifier of the file ip_blacklist_cloud.php of the component CSV File Import. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. Upgrading to version 3.43 is able to address this issue. The identifier of the patch is 6e6fe8c6fda7cbc252eef083105e08d759c07312. It is recommended to upgrade the affected component. The identifier VDB-227757 was assigned to this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00966 61st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—IP Blacklist Cloud Plugin3.0; 3.1; 3.2; 3.3; 3.4; 3.5; 3.6; 3.7; 3.8; 3.9; 3.10; 3.11; 3.12; 3.13; 3.14; 3.15; 3.16; 3.17; 3.18; 3.19; 3.20; 3.21; 3.22; 3.23; 3.24; 3.25; 3.26; 3.27; 3.28; 3.29; 3.30; 3.31; 3.32; 3.33; 3.34; 3.35; 3.36; 3.37; 3.38; 3.39; 3.40; 3.41; 3.42—No fix listedCNA
  • IP Blacklist Cloud Plugin Vendor— Affected 3.0; 3.1; 3.2; 3.3; 3.4; 3.5; 3.6; 3.7; 3.8; 3.9; 3.10; 3.11; 3.12; 3.13; 3.14; 3.15; 3.16; 3.17; 3.18; 3.19; 3.20; 3.21; 3.22; 3.23; 3.24; 3.25; 3.26; 3.27; 3.28; 3.29; 3.30; 3.31; 3.32; 3.33; 3.34; 3.35; 3.36; 3.37; 3.38; 3.39; 3.40; 3.41; 3.42 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ad33lx:ip_blacklist_cloud:*:*:*:*:*:wordpress:*:*up to 3.42VulnerableAd33lx
  • cpe:2.3:a:ad33lx:ip_blacklist_cloud:*:*:*:*:*:wordpress:*:* Versions up to 3.42 Vulnerable ·Ad33lx

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-10105
  2. 2026-10-03 Alias added: GHSA-pj62-8px7-m9hh

References

Patch 2

  • TI-2022-21254 WordPress IP Blacklist Cloud Plugin <= 5.00 is vulnerable to SQL Injection (SQLi) vulnerability CVSS 3.1CRITICAL 9.1
  • TI-2022-20661 WordPress IP Blacklist Cloud Plugin <= 5.00 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences