Vulnerabilities

TI-2026-02997 CVE-2026-3478 · GHSA-97j6-f74w-c455

Content Syndication Toolkit <= 1.3 - Unauthenticated Server-Side Request Forgery via 'url' Parameter

LOW 37

The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the redux_p AJAX action in the bundled ReduxFramework library.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00288 Published 2026-03-21 No fix listed CWE-918

TI-2025-10309 CVE-2025-11260 · GHSA-pg2r-c38p-237r

WP Headless CMS Framework <= 1.15 - Unauthenticated Protection Mechanism Bypass

LOW 30

The WP Headless CMS Framework plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.15.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0036 Published 2025-11-13 No fix listed CWE-693

TI-2024-34610 CVE-2024-51696 · GHSA-4gjx-hcpw-gq83

WordPress Content Syndication Toolkit Reader plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ben.moody Content Syndication Toolkit Reader content-syndication-toolkit-reader allows Reflected XSS.This issue affect…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00304 Published 2024-11-09 No fix listed CWE-79

TI-2024-34616 CVE-2024-51702 · GHSA-jjh7-589h-xm36

WordPress SrcSet Responsive Images for WordPress plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability