Vulnerabilities

TI-2026-03533 CVE-2026-4078 · GHSA-rfwp-57wg-5x36

ITERAS <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

LOW 28

The ITERAS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes (iteras-ordering, iteras-signup, iteras-paywall-login, iteras-selfservice) in all versions up to and including 1.8.2.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00257 Published 2026-04-24 No fix listed CWE-79

TI-2025-40816 CVE-2025-66371 · GHSA-24hm-wm2h-h8w7

XML external entity injection in ITERAS Peppol-py

LOW 23

Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00345 Published 2025-11-28 Fixed in 1.1.1 CWE-611

TI-2024-35908 CVE-2024-53710 · GHSA-ffrj-45c9-c9w8

WordPress ITERAS plugin <= 1.8.0 - CSRF to Stored XSS vulnerability

LOW 30

Cross-Site Request Forgery (CSRF) vulnerability in ITERAS ITERAS iteras allows Stored XSS.This issue affects ITERAS: from n/a through <= 1.8.0.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00184 Published 2024-12-02 No fix listed CWE-352

Vulnerabilities

Filters

ITERAS <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

XML external entity injection in ITERAS Peppol-py

WordPress ITERAS plugin <= 1.8.0 - CSRF to Stored XSS vulnerability