Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: halfdata Clear all filters
TI-2026-75238 CVE-2026-94388 · GHSA-rpvq-cc9f-qxvg

SQL injection in WordPress Green Popups plugin

Priority MEDIUM 45

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a befor…

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00229 Published 2026-10-16 Fixed in 7.6.3 CWE-89
TI-2026-25064 CVE-2026-32536 · GHSA-8vcc-333p-5pmv

WordPress Green Downloads plugin <= 2.08 - Arbitrary File Upload vulnerability

Priority MEDIUM 42

Unrestricted Upload of File with Dangerous Type vulnerability in halfdata Green Downloads halfdata-paypal-green-downloads allows Using Malicious Files.This issue affects Green Downloads: from n/a through <= 2.08.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00269 Published 2026-03-25 No fix listed CWE-434
TI-2022-26254 CVE-2022-50797 · GHSA-mr28-wxvw-q76j

Stripe Green Downloads Wordpress Plugin 2.03 Persistent XSS via Settings

Priority MEDIUM 56

Stripe Green Downloads Wordpress Plugin 2.03 contains a persistent cross-site scripting vulnerability allowing remote attackers to inject malicious scripts in button label fields.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00434 Published 2026-02-01 No fix listed CWE-79
TI-2024-09812 CVE-2024-10590 · GHSA-rfxx-rppr-xrjr

Opt-In Downloads <= 4.07 - Authenticated (Subscriber+) Arbitrary File Upload

Priority MEDIUM 42

The Opt-In Downloads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the admin_upload() function in all versions up to, and including, 4.07.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00834 Published 2024-12-12 No fix listed CWE-434