Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: InstaWP Component: String Locator Clear all filters
TI-2024-10137 CVE-2024-10936 · GHSA-mwfx-c8wp-957c

String Locator <= 2.6.6 - Unauthenticated PHP Object Injection

Priority MEDIUM 42

The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01139 Published 2025-01-21 No fix listed CWE-502
TI-2023-06388 CVE-2023-6987 · GHSA-3p4c-mxjg-9xjw

String Locator <= 2.6.5 - Reflected Cross-Site Scripting

Priority LOW 27

The String locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sql-column' parameter in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escapin…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00308 Published 2024-08-24 No fix listed CWE-79