Vulnerabilities

TI-2026-00936 CVE-2026-1215 · GHSA-r47q-hvhr-7cx6

MMA Call Tracking <= 2.3.15 - Cross-Site Request Forgery to Plugin Settings Update

LOW 19

The MMA Call Tracking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.15.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00183 Published 2026-02-11 No fix listed CWE-352

TI-2025-26184 CVE-2025-39442 · GHSA-6gc5-f7hf-hq2m

WordPress Review Wave – Google Places Reviews plugin <= 1.4.7 - Cross Site Request Forgery (CSRF) vulnerability

LOW 30

Cross-Site Request Forgery (CSRF) vulnerability in MessageMetric Review Wave – Google Places Reviews review-wave-google-places-reviews allows Stored XSS.This issue affects Review Wave – Google Places Reviews: from n/a th…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00152 Published 2025-04-17 No fix listed CWE-352

Vulnerabilities

Filters

MMA Call Tracking <= 2.3.15 - Cross-Site Request Forgery to Plugin Settings Update

WordPress Review Wave – Google Places Reviews plugin <= 1.4.7 - Cross Site Request Forgery (CSRF) vulnerability