Vulnerabilities

TI-2025-11089 CVE-2025-12092 · GHSA-x2hm-rp6m-pffv

CYAN Backup <= 2.5.4 - Authenticated (Admin+) Arbitrary File Deletion

LOW 30

The CYAN Backup plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete' functionality in all versions up to, and including, 2.5.4.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00776 Published 2025-11-08 No fix listed CWE-22

TI-2025-22073 CVE-2025-30803 · GHSA-gjhw-839g-27wc

WordPress Just Writing Statistics plugin <= 5.3 - Broken Access Control vulnerability

LOW 20

Missing Authorization vulnerability in Greg Ross Just Writing Statistics just-writing-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Just Writing Statistics: from n/…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0038 Published 2025-03-27 No fix listed CWE-862

TI-2024-37220 CVE-2024-56250 · GHSA-2293-ph8w-45mf

WordPress Just Writing Statistics plugin <= 4.7 - SQL Injection vulnerability

LOW 34

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Greg Ross Just Writing Statistics just-writing-statistics allows SQL Injection.This issue affects Just Writing Statist…

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00444 Published 2025-01-02 No fix listed CWE-89

TI-2024-35061 CVE-2024-52390 · GHSA-4ccx-55gp-x5qq

WordPress CYAN Backup plugin <= 2.5.3 - Arbitrary File Download vulnerability

LOW 23

Path Traversal: '.../...//' vulnerability in Greg Ross CYAN Backup cyan-backup allows Path Traversal.This issue affects CYAN Backup: from n/a through <= 2.5.3.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00539 Published 2024-11-18 No fix listed CWE-35

TI-2024-08768 CVE-2024-9449 · GHSA-rh7w-5pjq-mrjq

Auto iFrame <= 1.7 - Authenticated (Author+) Stored Cross-Site Scripting via tag Parameter

LOW 28

The Auto iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00333 Published 2024-10-09 No fix listed CWE-79

TI-2024-23510 CVE-2024-35641 · GHSA-39cr-m23q-9x5f

WordPress Just Writing Statistics plugin <= 4.5 - Cross Site Scripting (XSS) vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in GregRoss Just Writing Statistics allows Stored XSS.This issue affects Just Writing Statistics: from n/a through…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00259 Published 2024-06-03 No fix listed CWE-79