Vulnerabilities

TI-2026-01926 CVE-2026-2281 · GHSA-34f4-7p4v-274v

Private Comment <= 0.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Label Text Setting

LOW 20

The Private Comment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Label text' setting in all versions up to, and including, 0.0.4.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00275 Published 2026-02-18 No fix listed CWE-79

TI-2025-16570 CVE-2025-22688 · GHSA-62mj-f382-xrp2

WordPress Unlimited Page Sidebars plugin <= 0.2.6 - CSRF to Stored XSS vulnerability

LOW 30

Cross-Site Request Forgery (CSRF) vulnerability in Ederson Peka Unlimited Page Sidebars unlimited-page-sidebars allows Stored XSS.This issue affects Unlimited Page Sidebars: from n/a through <= 0.2.6.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00174 Published 2025-02-03 No fix listed CWE-352

TI-2025-18401 CVE-2025-24684 · GHSA-6c5r-r7hx-4v27

WordPress Media Downloader Plugin <= 0.4.7.5 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ederson Peka Media Downloader media-downloader allows Reflected XSS.This issue affects Media Downloader: from n/a thro…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00315 Published 2025-02-03 No fix listed CWE-79

TI-2024-36410 CVE-2024-54322 · GHSA-q4j5-q57w-hgq7

WordPress Media Downloader plugin <= 0.4.7.4 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 32