Vulnerabilities

TI-2025-39695 CVE-2025-64252 · GHSA-rpvq-43pv-vpgx

WordPress ANAC XML Viewer plugin <= 1.8.2 - Server Side Request Forgery (SSRF) vulnerability

LOW 30

Server-Side Request Forgery (SSRF) vulnerability in Marco Milesi ANAC XML Viewer anac-xml-viewer allows Server Side Request Forgery.This issue affects ANAC XML Viewer: from n/a through <= 1.8.2.

CVSS 3.1MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00216 Published 2026-01-22 No fix listed CWE-918

TI-2025-39038 CVE-2025-62888 · GHSA-h536-w556-w389

WordPress WP Attachments plugin <= 5.2 - Broken Access Control vulnerability

LOW 24

Missing Authorization vulnerability in Marco Milesi WP Attachments wp-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Attachments: from n/a through <= 5.2.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00202 Published 2025-12-31 No fix listed CWE-862

TI-2025-39703 CVE-2025-64260 · GHSA-qq4w-v87v-445v

WordPress ANAC XML Bandi di Gara plugin <= 7.7 - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marco Milesi ANAC XML Bandi di Gara avcp allows Reflected XSS.This issue affects ANAC XML Bandi di Gara: from n/a thro…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00213 Published 2025-12-18 No fix listed CWE-79

TI-2025-17586 CVE-2025-23819 · GHSA-pchf-fw93-3p2f

WordPress WP Cloud plugin <= 1.4.3 - Arbitrary File Deletion vulnerability

MEDIUM 40

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Marco Milesi WP Cloud cloud allows Absolute Path Traversal.This issue affects WP Cloud: from n/a through <= 1.4.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00586 Published 2025-02-03 No fix listed CWE-22

TI-2024-26022 CVE-2024-38789 · GHSA-pfxc-xwc8-3rwv

WordPress Telegram Bot & Channel plugin <= 3.8.2 - Cross Site Request Forgery (CSRF) vulnerability

LOW 23

Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi Telegram Bot & Channel telegram-bot allows Cross Site Request Forgery.This issue affects Telegram Bot & Channel: from n/a through <= 3.8.2.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.00186 Published 2025-01-02 No fix listed CWE-352

TI-2024-14878 CVE-2024-22291 · GHSA-xwf3-49mf-8pq7

WordPress Browser Theme Color Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 37

Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi Browser Theme Color.This issue affects Browser Theme Color: from n/a through 1.3.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00214 Published 2024-01-31 No fix listed CWE-352

TI-2023-25795 CVE-2023-47655 · GHSA-7v3h-7467-f5w5

WordPress ANAC XML Bandi di Gara Plugin <= 7.5 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi ANAC XML Bandi di Gara.This issue affects ANAC XML Bandi di Gara: from n/a through 7.5.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00269 Published 2023-11-18 No fix listed CWE-352

TI-2023-25560 CVE-2023-47242 · GHSA-f82r-h725-g32c

WordPress ANAC XML Bandi di Gara Plugin <= 7.5 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi ANAC XML Bandi di Gara plugin <= 7.5 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00386 Published 2023-11-16 No fix listed CWE-79

TI-2023-25563 CVE-2023-47245 · GHSA-q8qh-m64j-jhcc

WordPress ANAC XML Viewer Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi ANAC XML Viewer plugin <= 1.7 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00394 Published 2023-11-16 No fix listed CWE-79

TI-2023-25796 CVE-2023-47656 · GHSA-4m89-9vr4-fxx8

WordPress ANAC XML Bandi di Gara Plugin <= 7.5 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi ANAC XML Bandi di Gara plugin <= 7.5 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00406 Published 2023-11-14 No fix listed CWE-79

TI-2023-24532 CVE-2023-45758 · GHSA-wcj6-qwxq-5x5h

WordPress Amministrazione Trasparente Plugin <= 8.0.2 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi Amministrazione Trasparente plugin <= 8.0.2 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00509 Published 2023-10-24 No fix listed CWE-79

TI-2023-24452 CVE-2023-45651 · GHSA-hv42-72cg-mr2j

WordPress WP Attachments Plugin <= 5.0.11 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi WP Attachments allows Cross Site Request Forgery.This issue affects WP Attachments: from n/a through 5.0.11.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00259 Published 2023-10-16 No fix listed CWE-352

TI-2023-16873 CVE-2023-34006 · GHSA-fcfw-xh8r-p2xg

WordPress Telegram Bot & Channel Plugin <= 3.6.2 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi Telegram Bot & Channel plugin <= 3.6.2 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00369 Published 2023-06-22 No fix listed CWE-79

TI-2022-03965 CVE-2022-4330 · GHSA-7cjc-c9jv-7878

WP Attachments < 5.0.6 - Admin+ Stored XSS

LOW 23

The WP Attachments WordPress plugin before 5.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilt…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00475 Published 2023-01-16 Fixed in 5.0.6 CWE-79

TI-2022-03203 CVE-2022-3469 · GHSA-r5c5-p2gw-prwf

WP Attachments < 5.0.5 - Admin+ Stored Cross-Site Scripting

MEDIUM 55

The WP Attachments WordPress plugin before 5.0.5 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfil…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00583 Published 2022-11-14 Fixed in 5.0.5 CWE-79

Vulnerabilities

Filters