Vulnerabilities

TI-2026-03712 CVE-2026-4267 · GHSA-2xr4-chcf-vmvf

Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI

LOW 37

The Query Monitor – The developer tools panel for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘$_SERVER['REQUEST_URI']’ parameter in all versions up to, and including, 3.20.3 du…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00307 Published 2026-03-31 Fixed in 3.20.4 CWE-79

TI-2025-07942 CVE-2025-8678 · GHSA-35c5-67fm-cpcp

WP Crontrol - 1.17.0 - 1.19.1 - Authenticated (Administrator+) Blind Server-Side Request Forgery

LOW 28

The WP Crontrol plugin for WordPress is vulnerable to blind Server-Side Request Forgery in versions 1.17.0 to 1.19.1 via the 'wp_remote_request' function.

CVSS 3.1MEDIUM 5.9 Network High privileges No interaction EPSS 0.00363 Published 2025-08-22 Fixed in 1.19.2 CWE-918

TI-2024-19052 CVE-2024-28850 · GHSA-9xvf-cjvf-ff5q

WP Crontrol possible RCE when combined with a pre-condition

LOW 35

WP Crontrol controls the cron events on WordPress websites.

CVSS 3.1HIGH 8.2 Local No auth No interaction EPSS 0.00166 Published 2024-03-25 Fixed in 1.16.2 CWE-494

Vulnerabilities

Filters

Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI

WP Crontrol - 1.17.0 - 1.19.1 - Authenticated (Administrator+) Blind Server-Side Request Forgery

WP Crontrol possible RCE when combined with a pre-condition