Vulnerabilities

TI-2026-20428 CVE-2026-25310 · GHSA-427p-xgcr-j3hr

WordPress Extend Link plugin <= 2.0.0 - Server Side Request Forgery (SSRF) vulnerability

LOW 22

Server-Side Request Forgery (SSRF) vulnerability in Alobaidi Extend Link extend-link allows Server Side Request Forgery.This issue affects Extend Link: from n/a through <= 2.0.0.

CVSS 3.1MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00207 Published 2026-02-19 No fix listed CWE-918

TI-2025-12710 CVE-2025-13908 · GHSA-6352-39rh-mx5f

The Tooltip <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

LOW 28

The The Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'the_tooltip' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output esc…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0026 Published 2026-01-09 No fix listed CWE-79

TI-2025-08809 CVE-2025-9616 · GHSA-wvfg-qm7f-qwq3

PopAd <= 1.0.4 - Cross-Site Request Forgery to Settings Update

LOW 29

The PopAd plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00161 Published 2025-09-04 No fix listed CWE-352

TI-2025-07393 CVE-2025-8080 · GHSA-jh2h-g3rx-r698

Alobaidi Captcha <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings

LOW 20

The Alobaidi Captcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00274 Published 2025-08-15 No fix listed CWE-79

TI-2025-20127 CVE-2025-27280 · GHSA-c3ff-v8pw-m28w

WordPress Archive Page plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability