Vulnerabilities

TI-2026-08933 CVE-2026-10195 · GHSA-rh2h-qvw2-pj57

FS Poster <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting

MEDIUM 42

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01081 Published 2026-09-01 No fix listed CWE-77

TI-2025-22230 CVE-2025-30960 · GHSA-h3ww-cm3r-pwhx

WordPress FS Poster plugin <= 6.5.8 - Subscriber+ Site Wide Broken Access Control vulnerability

LOW 36

Missing Authorization vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster: from n/a through <= 6.5.8.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00316 Published 2025-04-16 No fix listed CWE-862

TI-2025-22232 CVE-2025-30962 · GHSA-496p-8p53-pf9q

WordPress FS Poster plugin <= 6.5.8 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fs-code FS Poster fs-poster allows Reflected XSS.This issue affects FS Poster: from n/a through <= 6.5.8.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00237 Published 2025-04-15 No fix listed CWE-79

TI-2024-12193 CVE-2024-13146 · GHSA-xpv6-mc85-j28m

Booknetic < 4.1.5 - Staff Creation via CSRF

HIGH 73

The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logged in admin add arbitrary Staff members via a CSRF attack

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0024 Published 2025-03-26 Fixed in 4.1.5 CWE-352

TI-2025-19849 CVE-2025-26978 · GHSA-87c8-vcwq-2gcc

WordPress FS Poster plugin <= 6.5.8 - SQL Injection vulnerability

LOW 37

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster: from n/a through <= 6.5.8.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00338 Published 2025-03-15 No fix listed CWE-89

TI-2024-24752 CVE-2024-37237 · GHSA-c3h4-65wr-9pqr

WordPress FS Poster plugin <= 6.5.8 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in fs-code FS Poster fs-poster allows Cross Site Request Forgery.This issue affects FS Poster: from n/a through <= 6.5.8.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00183 Published 2025-01-02 No fix listed CWE-352