Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: mitchelllevy Component: Ahathat Clear all filters
TI-2024-10439 CVE-2024-11269 · GHSA-7h9p-m872-c67m

AHAthat Plugin <= 1.6 - Admin+ SQL Injection

Priority HIGH 67

The AHAthat Plugin WordPress plugin through 1.6 does not sanitize and escape a parameter before using it in a SQL statement, allowing Admin to perform SQL injection attacks.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00586 Published 2025-05-15 No fix listed CWE-89
TI-2024-11687 CVE-2024-12595 · GHSA-6gg3-5p97-3cp8

AHAthat Plugin <= 1.6 - Reflected XSS via REQUEST_URI

Priority MEDIUM 55

The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00328 Published 2025-01-02 No fix listed CWE-79