Vulnerabilities

TI-2026-56890 CVE-2026-82530 · GHSA-hxq7-w32x-hwx5

IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header

LOW 37

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTT…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00443 Published 2026-09-09 Fixed in 2.45.0 CWE-290

TI-2022-26413 CVE-2022-50961 · GHSA-j23v-7p9x-7fcc

WordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSS

MEDIUM 56

WordPress Plugin IP2Location Country Blocker 2.26.7 contains a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary JavaScript code through the Frontend Settings interface.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00191 Published 2026-05-10 No fix listed CWE-79

TI-2025-26197 CVE-2025-39455 · GHSA-9mhf-v33v-gx4x

WordPress IP2Location Variables plugin <= 2.9.5 - CSRF to Cross Site Scripting (XSS) vulnerability

LOW 30

Cross-Site Request Forgery (CSRF) vulnerability in IP2Location IP2Location Variables ip2location-variables allows Reflected XSS.This issue affects IP2Location Variables: from n/a through <= 2.9.5.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00152 Published 2025-04-17 No fix listed CWE-352

TI-2025-23709 CVE-2025-32644 · GHSA-vrxx-q897-j52j

WordPress IP2Location World Clock Plugin <= 1.1.9 - CSRF to Stored XSS vulnerability

LOW 30

Cross-Site Request Forgery (CSRF) vulnerability in IP2Location IP2Location World Clock ip2location-world-clock allows Stored XSS.This issue affects IP2Location World Clock: from n/a through <= 1.1.9.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00177 Published 2025-04-09 No fix listed CWE-352

TI-2025-01291 CVE-2025-1502 · GHSA-pv28-xfr8-q7cp

IP2Location Redirection <= 1.33.3 - Missing Authorization to Unauthenticated Settings Export

LOW 30

The IP2Location Redirection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'download_ip2location_redirection_backup' AJAX action in all versions up to, and incl…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00298 Published 2025-03-01 No fix listed CWE-862

TI-2025-01166 CVE-2025-1361 · GHSA-xrwv-8jhj-x69w

Improper authorization in IP2Location Country Blocker

MEDIUM 41

The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing capability checks on the admin_init() function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01302 Published 2025-02-22 No fix listed CWE-285

TI-2025-18448 CVE-2025-24731 · GHSA-pf3h-gh3r-gj26

WordPress IP2Location Country Blocker plugin <= 2.38.3 - Cross Site Scripting (XSS) vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IP2Location Download IP2Location Country Blocker ip2location-country-blocker allows Stored XSS.This issue affects Down…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00323 Published 2025-01-24 No fix listed CWE-79

TI-2023-19304 CVE-2023-37865 · GHSA-427c-xc35-8535

WordPress IP2Location Country Blocker plugin <= 2.29.1 - IP Bypass Vulnerability vulnerability

LOW 24

Authentication Bypass by Spoofing vulnerability in IP2Location Download IP2Location Country Blocker allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Download IP2Location Country Blocker:…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00417 Published 2024-06-04 No fix listed CWE-290

TI-2024-21338 CVE-2024-32443 · GHSA-h8rh-j63f-hx2c

WordPress IP2Location Country Blocker plugin <= 2.34.2 - Cross Site Request Forgery (CSRF) vulnerability

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in IP2Location Download IP2Location Country Blocker.This issue affects Download IP2Location Country Blocker: from n/a through 2.34.2.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00241 Published 2024-04-15 No fix listed CWE-352

TI-2024-14881 CVE-2024-22294 · GHSA-v6qc-f595-6qvv

WordPress Download IP2Location Country Blocker Plugin <= 2.33.3 is vulnerable to Sensitive Data Exposure

LOW 39

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in IP2Location IP2Location Country Blocker.This issue affects IP2Location Country Blocker: from n/a through 2.33.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00453 Published 2024-01-24 No fix listed CWE-200

TI-2021-07386 CVE-2021-25108 · GHSA-r5r8-g427-8mp7

IP2Location Country Blocker < 2.26.6 - Arbitrary Country Ban via CSRF

LOW 32

The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00451 Published 2022-02-07 Fixed in 2.26.6 CWE-352

TI-2021-07374 CVE-2021-25096 · GHSA-j6r6-vg97-r68x

IP2Location Country Blocker < 2.26.5 - Ban Bypass

LOW 31

The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01047 Published 2022-02-07 Fixed in 2.26.5 CWE-639

TI-2021-07373 CVE-2021-25095 · GHSA-hgh9-57mp-975h

IP2Location Country Blocker < 2.26.5 - Subscriber+ Arbitrary Country Ban

LOW 32

The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX action, allowing any authenticated users, such as subscriber t…

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00537 Published 2022-02-07 Fixed in 2.26.5 CWE-352

Vulnerabilities

Filters