Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

10 records

Vendor: mischiefmarmot Clear all filters
TI-2026-11208 CVE-2026-13200 · GHSA-jhj7-pcmr-9q9p

Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter

Priority LOW 29

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of suffici…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00413 Published 2026-09-19 No fix listed CWE-89
TI-2026-11202 CVE-2026-13191 · GHSA-c79v-6v55-pvvh

Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order_by' Parameter

Priority LOW 29

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of suff…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00472 Published 2026-09-19 No fix listed CWE-89
TI-2025-26298 CVE-2025-39556 · GHSA-j7vf-7m65-7hhr

WordPress Mediavine Control Panel plugin <= 2.10.6 - Sensitive Data Exposure vulnerability

Priority LOW 31

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in mediavine Mediavine Control Panel mediavine-control-panel allows Retrieve Embedded Sensitive Data.This issue affects Mediavine C…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00501 Published 2025-04-16 No fix listed CWE-497
TI-2024-28871 CVE-2024-43218 · GHSA-rxwh-v4c9-c8v7

WordPress Mediavine Control Panel plugin <= 2.10.4 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mediavine Mediavine Control Panel mediavine-control-panel.This issue affects Mediavine Control Panel: from n/a through…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00259 Published 2024-08-12 No fix listed CWE-79
TI-2024-24999 CVE-2024-37495 · GHSA-48xh-4c4x-xghf

WordPress Create by Mediavine plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mischiefmarmot Create by Mediavine mediavine-create.This issue affects Create by Mediavine: from n/a through <= 1.9.7.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00279 Published 2024-07-21 No fix listed CWE-79
TI-2024-05203 CVE-2024-5601 · GHSA-7c7g-j7x8-cc4x

Create by Mediavine <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Schema Meta Shortcode

Priority LOW 28

The Create by Mediavine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Schema Meta shortcode in all versions up to, and including, 1.9.7 due to insufficient input sanitization and outp…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00321 Published 2024-06-27 No fix listed CWE-79
TI-2024-01591 CVE-2024-1711 · GHSA-42mp-pxm4-v723

Create by Mediavine <= 1.9.4 - Unauthenticated SQL Injection via 'id'

Priority MEDIUM 50

The Create by Mediavine plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.9.4 due to insufficient escaping on the user supplied parameter and lack of suffi…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00724 Published 2024-03-20 No fix listed CWE-89