Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

11 records

Vendor: f1logic Clear all filters
TI-2026-10379 CVE-2026-12042 · GHSA-5v5w-p5x3-68gq

WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter

Priority LOW 20

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00335 Published 2026-09-19 No fix listed CWE-79
TI-2025-11074 CVE-2025-12077 · GHSA-7g7g-5gf7-vcxp

WP to LinkedIn Auto Publish <= 1.9.8 - Reflected Cross-Site Scripting via PostMessage

Priority LOW 27

The WP to LinkedIn Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00249 Published 2025-12-13 No fix listed CWE-79
TI-2025-11073 CVE-2025-12076 · GHSA-g67m-j5mf-fc3x

Social Media Auto Publish <= 3.6.5 - Reflected Cross-Site Scripting via PostMessage

Priority LOW 27

The Social Media Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage parameter in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output e…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0025 Published 2025-12-13 No fix listed CWE-79
TI-2025-11076 CVE-2025-12079 · GHSA-9rf6-24pm-gw73

WP Twitter Auto Publish <= 1.7.4 - Reflected Cross-Site Scripting via PostMessage

Priority LOW 27

The WP Twitter Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00266 Published 2025-11-18 No fix listed CWE-79
TI-2025-11062 CVE-2025-12064 · GHSA-96cx-3fh6-vv56

WP2Social Auto Publish <= 2.4.7 - Reflected Cross-Site Scripting via PostMessage

Priority LOW 27

The WP2Social Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0022 Published 2025-11-08 No fix listed CWE-79
TI-2025-39789 CVE-2025-64356 · GHSA-jvpv-fpvh-5mfh

WordPress Insert PHP Code Snippet plugin <= 1.4.3 - Broken Access Control vulnerability

Priority LOW 19

Missing Authorization vulnerability in f1logic Insert PHP Code Snippet insert-php-code-snippet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Insert PHP Code Snippet: from n/a…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0021 Published 2025-10-31 No fix listed CWE-862
TI-2024-11929 CVE-2024-12873 · GHSA-4x2h-w98x-4p25

Custom Field Manager <= 1.0 - Reflected XSS Vulnerability

Priority MEDIUM 60

The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00589 Published 2025-05-15 No fix listed CWE-79
TI-2024-02132 CVE-2024-2295 · GHSA-6xph-25m2-x9mg

Contact Form Manager <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 28

The Contact Form Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [xyz-cfm-form] shortcode in all versions up to, and including, 1.6.1 due to insufficient input sanitization and…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00273 Published 2024-06-01 No fix listed CWE-79
TI-2024-00608 CVE-2024-0658 · GHSA-2g72-wghv-7rm3

Insert PHP Code Snippet <= 1.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting

Priority LOW 22

The Insert PHP Code Snippet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user's name when accessing the insert-php-code-snippet-manage page in all versions up to, and including, 1.3.4 due to…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00337 Published 2024-02-20 No fix listed CWE-79
TI-2020-18898 CVE-2020-36727 · GHSA-xj95-mhv8-mh4r

Newsletter Manager <= 1.5.1 - Insecure Deserialization

Priority MEDIUM 52

The Newsletter Manager plugin for WordPress is vulnerable to insecure deserialization in versions up to, and including, 1.5.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01615 Published 2023-06-07 No fix listed CWE-502