Vulnerabilities

TI-2026-75500 CVE-2026-111714 · GHSA-h33v-xq5w-v2mw

Regular expression denial of service in tarteaucitron.js cookie purge

LOW 11

tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00218 Published 2026-10-16 Fixed in 1.37.0 CWE-1333

TI-2026-75499 CVE-2026-111713 · GHSA-rfp9-xrhw-w637

Cross-site scripting in tarteaucitron.js via data-url attribute

LOW 22

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00171 Published 2026-10-16 Fixed in 1.37.0 CWE-79

TI-2026-67452 CVE-2026-103421 · GHSA-wh25-3f53-gw28

WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment

LOW 24

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI (path segment after /android_json/search/)' parameter in all versions up to, and inclu…

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00221 Published 2026-10-03 No fix listed CWE-79

TI-2026-65941 CVE-2026-94541 · GHSA-qhj3-2w8c-62vm

WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter

MEDIUM 49

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is author…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00494 Published 2026-10-02 No fix listed CWE-862

TI-2026-44356 CVE-2026-61984 · GHSA-8qr4-h7vm-7832

WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability

LOW 39

Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00394 Published 2026-08-13 No fix listed CWE-862

TI-2026-36810 CVE-2026-49977 · GHSA-jxj7-g6gm-49j7

tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies

LOW 20

tarteaucitron.js is a compliant and accessible cookie banner.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00354 Published 2026-07-17 Fixed in 1.33.0 CWE-285

TI-2026-18326 CVE-2026-22809 · GHSA-q5f6-qxm2-mcqm

tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability

LOW 19

tarteaucitron.js is a compliant and accessible cookie banner.

CVSS 3.1MEDIUM 4.4 Local High privileges No interaction EPSS 0.00128 Published 2026-01-13 Fixed in 1.29.0 CWE-1333

TI-2025-38397 CVE-2025-62074 · GHSA-x2hr-gg7q-66w5

WordPress WPMobile.App plugin <= 11.71 - Cross Site Scripting (XSS) vulnerability

LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects WPMobile.App: from n/a through <= 11.71.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00185 Published 2025-11-06 No fix listed CWE-79

TI-2025-31077 CVE-2025-48939 · GHSA-q43x-79jr-cq98

tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript

LOW 19

tarteaucitron.js is a compliant and accessible cookie banner.

CVSS 3.1MEDIUM 4.2 Local High privileges User interaction EPSS 0.00202 Published 2025-07-03 Fixed in 1.22.0 CWE-138

TI-2025-04443 CVE-2025-4955 · GHSA-23mx-m43g-r4fh

tarteaucitron.io < 1.9.5 - Contributor+ Stored XSS

MEDIUM 55

The tarteaucitron.io WordPress plugin before 1.9.5 uses query parameters from YouTube oEmbed URLs without sanitizing these parameters correctly, which could allow users with the contributor role and above to perform Stor…

CVSS 3.1MEDIUM 4.7 Network High privileges No interaction EPSS 0.00375 Published 2025-06-18 Fixed in 1.9.5 CWE-79

TI-2025-22657 CVE-2025-31476 · GHSA-p5g4-v748-6fh8

tarteaucitron.js allows url scheme injection via unfiltered inputs

LOW 22

tarteaucitron.js is a compliant and accessible cookie banner.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0036 Published 2025-04-07 Fixed in 1.20.1 CWE-79

TI-2025-22656 CVE-2025-31475 · GHSA-4hwx-xcc5-2hfc

tarteaucitron.js allows prototype pollution via custom text injection

LOW 31

tarteaucitron.js is a compliant and accessible cookie banner.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.00351 Published 2025-04-07 Fixed in 1.20.1 CWE-1321

TI-2025-22399 CVE-2025-31138 · GHSA-7524-3396-fqv3

tarteaucitron.js allows UI manipulation via unrestricted CSS injection

LOW 31

tarteaucitron.js is a compliant and accessible cookie banner.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.00271 Published 2025-04-07 Fixed in 1.20.1 CWE-1021

TI-2024-12908 CVE-2024-13888 · GHSA-56h9-pghv-8mp7

WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameter

LOW 33

The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0076 Published 2025-02-20 No fix listed CWE-601

TI-2024-11523 CVE-2024-12420 · GHSA-8j5q-4jr8-p73w

WPMobile.App — Android and iOS Mobile Application <= 11.52 - Unauthenticated Arbitrary Shortcode Execution

LOW 35

The The WPMobile.App — Android and iOS Mobile Application plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.52.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00381 Published 2024-12-13 No fix listed CWE-94

TI-2024-29522 CVE-2024-43933 · GHSA-xrf5-2fh4-5hqj

WordPress WPMobile.App plugin <= 11.48 - CSRF to Stored XSS vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja allows Stored XSS.This issue affects WPMobile.App: from n/a through <= 11.48.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.003 Published 2024-10-31 No fix listed CWE-79

TI-2024-31667 CVE-2024-47349 · GHSA-hwvc-jmmq-rh9w

WordPress WPMobile.App plugin <= 11.50 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects WPMobile.App: from n/a through <= 11.50.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0032 Published 2024-10-06 No fix listed CWE-79

TI-2024-23563 CVE-2024-35694 · GHSA-557h-3h68-5wv4

WordPress WPMobile.App plugin <= 11.41 - Cross Site Scripting (XSS) vulnerability

LOW 32

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects WPMobile.App: from n/a through <= 11.41.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00663 Published 2024-06-08 No fix listed CWE-79

TI-2023-03379 CVE-2023-3620 · GHSA-f44m-65h3-99vc

Cross-site Scripting (XSS) - Stored in amauric/tarteaucitron.js

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository amauric/tarteaucitron.js prior to v1.13.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00542 Published 2023-07-11 Fixed in v1.13.1, 1.13.1 CWE-79

TI-2023-13409 CVE-2023-28932 · GHSA-q2j4-85pq-x399

WordPress WPMobile.App Plugin <= 11.20 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPMobile.App WPMobile.App — Android and iOS Mobile Application plugin <= 11.20 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00369 Published 2023-05-10 No fix listed CWE-79

TI-2023-11251 CVE-2023-26010 · GHSA-xh37-7fm5-6m6h

WordPress WPMobile.App Plugin <= 11.18 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPMobile.App plugin <= 11.18 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00369 Published 2023-05-04 No fix listed CWE-79

TI-2023-08877 CVE-2023-22702 · GHSA-6grr-xmf3-hgjf

WordPress WPMobile.App — Android and iOS Mobile Application Plugin <= 11.13 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in WPMobile.App WPMobile.App — Android and iOS Mobile Application plugin <= 11.13 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00383 Published 2023-03-23 No fix listed CWE-79

Vulnerabilities

Filters