Vulnerabilities

TI-2026-63006 CVE-2026-93512 · GHSA-86x3-j3wx-4cmm

WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability

LOW 30

Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00175 Published 2026-09-30 No fix listed CWE-79

TI-2026-28585 CVE-2026-39614 · GHSA-665f-vrmf-89j8

WordPress JW Player for WordPress plugin <= 2.3.6 - Broken Access Control vulnerability

LOW 24

Missing Authorization vulnerability in ilGhera JW Player for WordPress jw-player-7-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JW Player for WordPress: from n/a throu…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00171 Published 2026-04-08 No fix listed CWE-862

TI-2025-23581 CVE-2025-32516 · GHSA-9r63-r7rf-2xgc

WordPress Related Videos for JW Player plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ilGhera Related Videos for JW Player related-videos-for-jw-player allows Reflected XSS.This issue affects Related Vide…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00293 Published 2025-04-17 No fix listed CWE-79

TI-2024-12562 CVE-2024-13521 · GHSA-3m9j-8q5f-868v

MailUp Auto Subscription <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

LOW 26

The MailUp Auto Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00143 Published 2025-01-28 No fix listed CWE-352

TI-2023-22110 CVE-2023-41686 · GHSA-jfr2-m965-cp8h

WordPress Woocommerce Support System plugin <= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability

HIGH 68

Cross-Site Request Forgery (CSRF) vulnerability in ilGhera Woocommerce Support System allows Cross Site Request Forgery.This issue affects Woocommerce Support System: from n/a through 1.2.2.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00323 Published 2024-12-13 No fix listed CWE-352

TI-2024-22401 CVE-2024-33931 · GHSA-xpwv-75x9-38q4

WordPress JW Player for WordPress plugin <= 2.3.3 - Broken Access Control vulnerability

LOW 29

Missing Authorization vulnerability in ilGhera JW Player for WordPress.This issue affects JW Player for WordPress: from n/a through 2.3.3.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00429 Published 2024-05-03 No fix listed CWE-862

TI-2023-22109 CVE-2023-41685 · GHSA-hcrv-8mmq-xp49

WordPress Woocommerce Support System Plugin <= 1.2.1 is vulnerable to SQL Injection

MEDIUM 50

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ilGhera Woocommerce Support System allows SQL Injection.This issue affects Woocommerce Support System: from n/a throug…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00681 Published 2023-11-06 No fix listed CWE-89