Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: mitchelllevy Clear all filters
TI-2024-10439 CVE-2024-11269 · GHSA-7h9p-m872-c67m

AHAthat Plugin <= 1.6 - Admin+ SQL Injection

Priority HIGH 67

The AHAthat Plugin WordPress plugin through 1.6 does not sanitize and escape a parameter before using it in a SQL statement, allowing Admin to perform SQL injection attacks.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00586 Published 2025-05-15 No fix listed CWE-89
TI-2025-02182 CVE-2025-2511 · GHSA-v433-frww-q6q8

AHAthat Plugin <= 1.6 - Authenticated (Administrator+) SQL Injection via id Parameter

Priority LOW 22

The AHAthat Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.6 due to insufficient escaping on the user supplied parameter and lack of s…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00355 Published 2025-03-19 No fix listed CWE-89
TI-2024-11687 CVE-2024-12595 · GHSA-6gg3-5p97-3cp8

AHAthat Plugin <= 1.6 - Reflected XSS via REQUEST_URI

Priority MEDIUM 55

The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00328 Published 2025-01-02 No fix listed CWE-79