Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: Crowd Favorite Clear all filters
TI-2026-81969 CVE-2026-115607 · GHSA-gj44-v26q-v728

SQL injection in Crowd Favorite DXP ToolKit WordPress plugin

Priority MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00236 Published 2026-10-28 No fix listed CWE-89
TI-2026-81968 CVE-2026-115606 · GHSA-2478-mm55-gm6c

Stored cross-site scripting in Crowd Favorite DXP ToolKit plugin

Priority LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows Stored XSS.This issue affects DXP ToolKit: from n/a through 2.0.1.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00146 Published 2026-10-28 No fix listed CWE-79
TI-2024-11508 CVE-2024-12404 · GHSA-p2jc-29qr-48gx

CF Internal Link Shortcode <= 1.1.0 - Unauthenticated SQL Injection

Priority MEDIUM 40

The CF Internal Link Shortcode plugin for WordPress is vulnerable to SQL Injection via the 'post_title' parameter in all versions up to, and including, 1.1.0 due to insufficient escaping on the user supplied parameter an…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00843 Published 2025-01-11 No fix listed CWE-89
TI-2022-02009 CVE-2022-2171 · GHSA-j2wv-pvcq-h7hf

Progressive License <= 1.1.0 - CSRF to Stored XSS

Priority LOW 24

The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00315 Published 2022-08-01 No fix listed CWE-352