Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: neofix Clear all filters
TI-2025-11538 CVE-2025-12583 · GHSA-c563-3pgf-9rc7

Simple Downloads List <= 1.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

Priority LOW 28

The Simple Downloads List plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_neofix_sdl_edit' AJAX endpoint along with many others in all versions up…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00231 Published 2025-11-08 No fix listed CWE-862
TI-2024-12635 CVE-2024-13594 · GHSA-xcxq-gp74-3365

Simple Downloads List <= 1.4.2 - Authenticated (Contributor+) SQL Injection

Priority LOW 29

The Simple Downloads List plugin for WordPress is vulnerable to SQL Injection via the 'category' attribute of the 'neofix_sdl' shortcode in all versions up to, and including, 1.4.2 due to insufficient escaping on the use…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00416 Published 2025-01-24 No fix listed CWE-89