Vulnerabilities

TI-2026-01925 CVE-2026-2280 · GHSA-3xwf-6qxg-mrv7

rexCrawler <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings

LOW 22

The rexCrawler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0023 Published 2026-05-27 No fix listed CWE-79

TI-2026-01922 CVE-2026-2277 · GHSA-r773-4wcf-9vm6

rexCrawler <= 1.0.15 - Reflected Cross-Site Scripting via 'url' and 'regex' Parameters

LOW 27

The rexCrawler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' and 'regex' parameters in the search-pattern tester page in all versions up to, and including, 1.0.15 due to insufficient…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00281 Published 2026-03-21 No fix listed CWE-79

Vulnerabilities

Filters

rexCrawler <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings

rexCrawler <= 1.0.15 - Reflected Cross-Site Scripting via 'url' and 'regex' Parameters