Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: horearadu Clear all filters
TI-2025-11026 CVE-2025-12027 · GHSA-424x-j3vx-fpm5

Mesmerize Companion <= 1.6.158 - Missing Authorization Authenticated (Subscriber+) Settings Update

Priority LOW 20

The Mesmerize Companion plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the "openPageInCustomizer" and "openPageInDefaultEditor" functions in all ve…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00313 Published 2026-02-19 No fix listed CWE-862
TI-2026-19783 CVE-2026-24543 · GHSA-9646-v778-vv65

WordPress Materialis Companion plugin <= 1.3.52 - Broken Access Control vulnerability

Priority LOW 19

Missing Authorization vulnerability in Horea Radu Materialis Companion materialis-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Materialis Companion: from n/a throug…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0022 Published 2026-01-23 No fix listed CWE-862
TI-2024-04376 CVE-2024-4703 · GHSA-c4w3-rhwj-fj85

Cross-site scripting in horearadu One Page Express Companion

Priority LOW 28

The One Page Express Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's one_page_express_contact_form shortcode in all versions up to, and including, 1.6.37 due to insufficient i…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00263 Published 2024-06-07 No fix listed CWE-79
TI-2024-04380 CVE-2024-4707 · GHSA-vhgg-c8h4-x9hr

Cross-site scripting in horearadu Materialis Companion

Priority LOW 28

The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis_contact_form shortcode in all versions up to, and including, 1.3.41 due to insufficient input sanitiz…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00322 Published 2024-06-06 No fix listed CWE-79
TI-2024-03259 CVE-2024-3494 · GHSA-gc8p-39g7-4mhp

Cross-site scripting in horearadu Mesmerize Companion

Priority LOW 28

The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerize_contact_form' shortcode in all versions up to, and including, 1.6.148 due to insufficient input saniti…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00333 Published 2024-05-08 No fix listed CWE-79