Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

9 records

Vendor: odude Clear all filters
TI-2025-08369 CVE-2025-9129 · GHSA-pqgg-4fqm-2fwc

Flexi <= 4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via flexi-form-tag Shortcode

Priority LOW 28

The Flexi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's flexi-form-tag shortcode in all versions up to, and including, 4.28 due to insufficient input sanitization and ou…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00247 Published 2025-10-03 No fix listed CWE-79
TI-2025-23654 CVE-2025-32589 · GHSA-9rpg-mqj8-44g5

WordPress Flexi – Guest Submit Plugin <= 4.28 - Local File Inclusion vulnerability

Priority LOW 39

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in odude Flexi – Guest Submit flexi allows PHP Local File Inclusion.This issue affects Flexi – Guest S…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01041 Published 2025-04-11 No fix listed CWE-98
TI-2024-09272 CVE-2024-9989 · GHSA-hmfh-w3mx-w6j4

Crypto <= 2.18 - Authentication Bypass via log_in

Priority MEDIUM 59

The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.18.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07112 Published 2024-10-29 No fix listed CWE-288
TI-2024-09271 CVE-2024-9988 · GHSA-3xw3-m65r-4f37

Crypto <= 2.19 - Authentication Bypass via register

Priority MEDIUM 51

The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.19.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01102 Published 2024-10-29 No fix listed CWE-288
TI-2022-03725 CVE-2022-4060 · GHSA-g823-9xxv-px4q

User Post Gallery <= 2.19 - Unauthenticated RCE

Priority HIGH 82

The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.42723 Published 2023-01-16 No fix listed
TI-2022-00372 CVE-2022-0449 · GHSA-hgvr-3m27-2x5c

Flexi - Guest Submit < 4.20 - Reflected Cross-Site Scripting

Priority LOW 29

The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.008 Published 2022-03-14 Fixed in 4.20 CWE-79