Vulnerabilities

TI-2025-39189 CVE-2025-63041 · GHSA-xwqq-7m42-6939

WordPress Forget About Shortcode Buttons plugin <= 2.1.3 - Broken Access Control vulnerability

LOW 24

Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00287 Published 2026-06-26 No fix listed CWE-862

TI-2025-39144 CVE-2025-62996 · GHSA-5cg2-jcph-jfrc

WordPress Custom Layouts – Post + Product grids made easy plugin <= 1.4.12 - Broken Access Control vulnerability

LOW 19

Missing Authorization vulnerability in Code Amp Custom Layouts – Post + Product grids made easy custom-layouts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Layouts – P…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0022 Published 2025-12-09 No fix listed CWE-862

TI-2025-30469 CVE-2025-48099 · GHSA-2r8h-2rq3-qxmx

WordPress Search & Filter plugin <= 1.2.17 - Cross Site Request Forgery (CSRF) to Open Redirect vulnerability

LOW 21

Cross-Site Request Forgery (CSRF) vulnerability in Code Amp Search & Filter search-filter allows Cross Site Request Forgery.This issue affects Search & Filter: from n/a through <= 1.2.17.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00186 Published 2025-10-22 No fix listed CWE-352

TI-2024-28957 CVE-2024-43305 · GHSA-w8m3-qvxw-x4hh

WordPress Custom Layouts – Post + Product grids made easy plugin <= 1.4.11 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Code Amp Custom Layouts – Post + Product grids made easy allows Stored XSS.This issue affects Custom Layouts –…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00253 Published 2024-08-18 No fix listed CWE-79

TI-2024-06012 CVE-2024-6481 · GHSA-qmvr-hqqr-gjg7

Search Filter Pro < 2.5.18 - Admin+ Stored XSS

MEDIUM 55

The Search & Filter Pro WordPress plugin before 2.5.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00311 Published 2024-08-08 Fixed in 2.5.18 CWE-79

TI-2022-04082 CVE-2022-4467 · GHSA-3f6q-pc55-vgqv

Search & Filter < 1.2.16 - Contributor+ Stored XSS

MEDIUM 58

The Search & Filter WordPress plugin before 1.2.16 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perfo…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00476 Published 2023-01-23 Fixed in 1.2.16