Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: AccessAlly Clear all filters
TI-2020-19010 CVE-2020-36875 · GHSA-w273-q2jx-gwwp

AccessAlly < 3.3.2 Unauthenticated Arbitrary PHP Code Execution

Priority HIGH 81

AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code execution vulnerability in the Login Widget.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00758 Published 2026-01-09 Fixed in 3.3.2 CWE-94
TI-2024-23083 CVE-2024-34796 · GHSA-fgm5-jgr7-5rfv

WordPress PopupAlly plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability

Priority LOW 26

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AccessAlly PopupAlly allows Stored XSS.This issue affects PopupAlly: from n/a through 2.1.1.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00276 Published 2024-06-03 No fix listed CWE-79
TI-2024-22223 CVE-2024-33639 · GHSA-j2hp-jqgm-85pf

WordPress PopupAlly plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AccessAlly PopupAlly allows Stored XSS.This issue affects PopupAlly: from n/a through 2.1.1.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00356 Published 2024-04-26 No fix listed CWE-79
TI-2021-06518 CVE-2021-24226 · GHSA-3hqr-g258-rfxm

AccessAlly < 3.5.7 - $_SERVER Superglobal Leakage

Priority MEDIUM 41

In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcode is dumping serialize($_SERVER), which contains all environ…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05259 Published 2021-04-12 Fixed in 3.5.7 CWE-200