Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

13 records

Vendor: Lester Chan Clear all filters
TI-2025-41295 CVE-2025-67541 · GHSA-m4cg-3fm9-j6x9

WordPress WP-ShowHide plugin <= 1.05 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lester Chan WP-ShowHide wp-showhide allows Stored XSS.This issue affects WP-ShowHide: from n/a through <= 1.05.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00196 Published 2025-12-09 No fix listed CWE-79
TI-2024-31659 CVE-2024-47341 · GHSA-f79x-5q94-7w7h

WordPress WP-DownloadManager plugin <= 1.68.8 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lester Chan WP-DownloadManager wp-downloadmanager allows Reflected XSS.This issue affects WP-DownloadManager: from n/a…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0032 Published 2024-10-06 No fix listed CWE-79
TI-2024-26583 CVE-2024-39659 · GHSA-pwrj-w99j-qxmh

WordPress WP-PostRatings plugin <= 1.91.1 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Stored XSS.This issue affects WP-PostRatings: from n/a through 1.91.…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00295 Published 2024-08-01 No fix listed CWE-79
TI-2023-21161 CVE-2023-40332 · GHSA-rcjq-rrm8-5g33

WordPress WP-PostRatings plugin <= 1.91 - Rating limit Bypass vulnerability

Priority MEDIUM 48

Improper Control of Interaction Frequency vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Functionality Misuse.This issue affects WP-PostRatings: from n/a through 1.91.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00444 Published 2024-06-04 No fix listed CWE-799
TI-2021-07395 CVE-2021-25117 · GHSA-5c46-pxg6-m63r

WP Postratings < 1.86.1 - Admin+ Stored Cross-Site Scripting

Priority MEDIUM 55

The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratings_image parameter from its options page (wp-admin/admin.php?page=wp-postratings/postratings-options.php).

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00224 Published 2024-01-16 Fixed in 1.86.1 CWE-352
TI-2023-05118 CVE-2023-5560 · GHSA-3v9m-2r3c-48wc

WP-UserOnline < 2.88.3 - Unauthenticated Stored XSS

Priority MEDIUM 60

The WP-UserOnline WordPress plugin before 2.88.3 does not sanitise and escape the X-Forwarded-For header before outputting its content on the page, which allows unauthenticated users to perform Cross-Site Scripting attac…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0051 Published 2023-11-27 Fixed in 2.88.3 CWE-79
TI-2023-03475 CVE-2023-3721 · GHSA-f5m5-p2rg-3999

WP-EMail < 2.69.1 - Admin+ Stored Cross-Site Scripting

Priority MEDIUM 55

The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0047 Published 2023-08-14 Fixed in 2.69.1 CWE-79
TI-2013-02841 CVE-2013-3252 · GHSA-fw94-5mx7-v5hw

Cross-site request forgery (CSRF) vulnerability in the options admin page in the…

Priority LOW 32

Cross-site request forgery (CSRF) vulnerability in the options admin page in the WP-PostViews plugin before 1.63 for WordPress allows remote attackers to hijack the authentication of administrators for requests that chan…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.0109 Published 2014-04-10 No fix listed CWE-352
TI-2011-04006 CVE-2011-4646 · GHSA-chv6-6f32-gc59

SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50…

Priority LOW 30

SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions before 1.62 for WordPress allows remote authenticated users with the Author role to execute arbitrary…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.01505 Published 2011-11-30 No fix listed CWE-94