Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

10 records

Vendor: jdsofttech Clear all filters
TI-2025-10984 CVE-2025-11981 · GHSA-fp65-cx5q-8fg9

School Management System – WPSchoolPress <= 2.2.23 - Authenticated (Administrator+) SQL Injection

Priority LOW 22

The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'SCodes' parameter in all versions up to, and including, 2.2.23 due to insufficient escaping on the user supplied p…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0033 Published 2025-11-14 No fix listed CWE-89
TI-2025-01434 CVE-2025-1668 · GHSA-q2m5-q4jg-g9g2

School Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Arbitrary User Deletion

Priority LOW 24

The School Management System – WPSchoolPress plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check on the wpsp_DeleteUser() function in all versions up to, and including, 2.2.16.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00304 Published 2025-03-15 No fix listed CWE-862
TI-2025-01436 CVE-2025-1670 · GHSA-cpfc-m8w6-m9gf

School Management System – WPSchoolPress <= 2.2.16 - Authenticated (Parent+) SQL Injection

Priority LOW 29

The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including, 2.2.16 due to insufficient escaping on the user supplied para…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00384 Published 2025-03-15 No fix listed CWE-89
TI-2025-01433 CVE-2025-1667 · GHSA-4mr4-q2q7-hmgc

School Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Privilege Escalation via Account Takeover

Priority MEDIUM 40

The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wpsp_UpdateTeacher() function in all versions up to, and including, 2.2.16.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00368 Published 2025-03-15 No fix listed CWE-639
TI-2025-01435 CVE-2025-1669 · GHSA-2x2q-xfv9-3v6p

School Management System – WPSchoolPress <= 2.2.17 - Authenticated (Teacher+) SQL Injection

Priority LOW 29

The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'addNotify' action in all versions up to, and including, 2.2.17 due to insufficient escaping on the user supplied p…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00384 Published 2025-03-15 No fix listed CWE-89
TI-2024-11439 CVE-2024-12332 · GHSA-5g7x-mpmc-q8w8

School Management System – WPSchoolPress <= 2.2.14 - Authenticated (Student/Parent+) SQL Injection

Priority LOW 29

The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including, 2.2.14 due to insufficient escaping on the user supplied para…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00439 Published 2025-01-07 No fix listed CWE-89
TI-2023-04403 CVE-2023-4776 · GHSA-f7v3-rpm4-hwv2

WPSchoolPress < 2.2.5 - Teacher+ SQLi

Priority HIGH 73

The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relativel…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00907 Published 2023-10-16 Fixed in 2.2.5 CWE-89
TI-2021-06946 CVE-2021-24664 · GHSA-v58g-4h5m-gvqg

WPSchoolPress < 2.1.17 - Multiple Admin+ Stored Cross-Site Scripting

Priority LOW 27

The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributes, resulting in Stored Cross-Site Script…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.02358 Published 2021-11-08 Fixed in 2.1.17 CWE-79
TI-2021-06859 CVE-2021-24575 · GHSA-jx26-7xc3-2xc3

WPSchoolPress < 2.1.10 - Multiple Authenticated SQL Injections

Priority MEDIUM 41

The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before using POST variable in SQL queries, leading to SQL injection in multiple actions av…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01361 Published 2021-11-08 Fixed in 2.1.10 CWE-89