Vulnerabilities

TI-2026-22499 CVE-2026-28158 · GHSA-g558-c2fq-4jgq

WordPress Do Lasso plugin <= 358 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-08-13 No fix listed CWE-79

TI-2026-22498 CVE-2026-28157 · GHSA-36hp-4q45-jxjc

LOW 35

Subscriber Path Traversal in Do Lasso <= 358 versions.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00409 Published 2026-08-13 No fix listed CWE-35

TI-2026-22497 CVE-2026-28156 · GHSA-87hp-hrvg-crh2

LOW 37

Subscriber SQL Injection in Do Lasso <= 358 versions.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00357 Published 2026-08-13 No fix listed CWE-89

TI-2026-22496 CVE-2026-28155 · GHSA-gcxj-g9hm-45pg

LOW 35

Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00332 Published 2026-08-13 No fix listed CWE-639