Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: taskbuilder Component: Taskbuilder Clear all filters
TI-2024-09124 CVE-2024-9831 · GHSA-qrqf-gfw2-2f89

Taskbuilder < 3.0.9 - Admin+ SQL Injection

Priority HIGH 67

The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00586 Published 2025-05-15 Fixed in 3.0.9 CWE-89
TI-2025-16598 CVE-2025-22716 · GHSA-rj76-j4fr-rh37

WordPress Taskbuilder Plugin <= 3.0.6 - SQL Injection vulnerability

Priority MEDIUM 44

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in taskbuilder Taskbuilder taskbuilder allows SQL Injection.This issue affects Taskbuilder: from n/a through <= 3.0.6.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00444 Published 2025-01-21 No fix listed CWE-89
TI-2024-11068 CVE-2024-11930 · GHSA-v26g-qqjw-5qgq

Cross-site scripting in Taskbuilder – Project Management & Task Management Tool With…

Priority LOW 28

The Taskbuilder – WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppm_tasks shortcode in all versions up to, and including, 3.0.6 due to insu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00321 Published 2025-01-04 No fix listed CWE-79
TI-2024-09121 CVE-2024-9828 · GHSA-97cw-cf8m-4xxc

Taskbuilder < 3.0.5 - Admin+ SQL Injection

Priority MEDIUM 52

The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it in a SQL statement, allowing high privilege users such as admin to perform SQL Injection attacks

CVSS 3.1MEDIUM 4.1 Network High privileges No interaction EPSS 0.00504 Published 2024-11-21 Fixed in 3.0.5 CWE-89
TI-2022-02896 CVE-2022-3137 · GHSA-mf4x-mpcx-4r8x

TaskBuilder < 1.0.8 - Subscriber+ Stored XSS via SVG file upload

Priority LOW 25

The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber) creating a task to perform Stored Cross-Site Scripting by att…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.006 Published 2022-10-10 Fixed in 1.0.8 CWE-79