Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

10 records

Vendor: DuoGeek Clear all filters
TI-2025-02154 CVE-2025-2479 · GHSA-w8cc-2xf5-pph4

Easy Custom Admin Bar <= 1.0 - Reflected Cross-Site Scripting via msg Parameter

Priority LOW 27

The Easy Custom Admin Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘msg’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00342 Published 2025-03-22 No fix listed CWE-79
TI-2025-01815 CVE-2025-2077 · GHSA-4cv3-5jc2-7cmw

Simple Amazon Affiliate <= 1.0.9 - Reflected Cross-Site Scripting

Priority LOW 27

The Simple Amazon Affiliate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'msg' parameter in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escap…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00311 Published 2025-03-12 No fix listed CWE-79
TI-2025-17553 CVE-2025-23786 · GHSA-qq7r-jjr4-m4cx

WordPress Email to Download Plugin <= 3.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Email to Download email-to-download allows Reflected XSS.This issue affects Email to Download: from n/a throug…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00308 Published 2025-02-14 No fix listed CWE-79
TI-2024-37060 CVE-2024-56024 · GHSA-rfmf-6824-3rxj

WordPress Custom Dashboard Widget plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Custom Dashboard Widget create-custom-dashboard-widget allows Reflected XSS.This issue affects Custom Dashboar…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00354 Published 2025-01-02 No fix listed CWE-79
TI-2024-34764 CVE-2024-51860 · GHSA-jhv7-p7w6-pw88

WordPress Custom Dashboard Widget plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Custom Dashboard Widget create-custom-dashboard-widget allows Stored XSS.This issue affects Custom Dashboard W…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00339 Published 2024-11-19 No fix listed CWE-79
TI-2024-34532 CVE-2024-51618 · GHSA-2m2h-p645-jchp

WordPress Custom Admin Menu plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Custom Admin Menu custom-admin-menu allows Stored XSS.This issue affects Custom Admin Menu: from n/a through <…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00263 Published 2024-11-09 No fix listed CWE-79
TI-2022-01105 CVE-2022-1218 · GHSA-qjq8-6wjp-3w9f

Domain Replace <= 1.3.8 - Reflected Cross-Site Scripting

Priority LOW 29

The Domain Replace WordPress plugin through 1.3.8 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.008 Published 2022-05-23 No fix listed CWE-79
TI-2021-16685 CVE-2021-39313 · GHSA-9j6h-6x9c-qmfv

Simple Image Gallery <= 1.0.6 Reflected Cross-Site Scripting

Priority LOW 29

The Simple Image Gallery WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/simple-image-gallery.php file which allows attackers to inject arbitrary web scripts, in vers…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00782 Published 2021-12-14 No fix listed CWE-79
TI-2021-16691 CVE-2021-39319 · GHSA-2pv7-4f3r-r2rg

duoFAQ - Responsive, Flat, Simple FAQ <= 1.4.8 Reflected Cross-Site Scripting

Priority LOW 29

The duoFAQ - Responsive, Flat, Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/duogeek/duogeek-panel.php file which allows attackers to inject arbitrary web…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00782 Published 2021-12-14 No fix listed CWE-79