Vulnerabilities

TI-2026-65998 CVE-2026-97637 · GHSA-pmrp-gw7x-5x4r

JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response

MEDIUM 50

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00636 Published 2026-10-02 No fix listed CWE-287

TI-2026-08455 CVE-2026-9626 · GHSA-4689-rgvq-62r3

JSON API User <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter

LOW 29

The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the post_comment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input s…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00375 Published 2026-07-03 No fix listed CWE-79

TI-2024-06142 CVE-2024-6624 · GHSA-mxf2-3xcv-2mf9

JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation

MEDIUM 54

The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0287 Published 2024-07-11 No fix listed CWE-269

Vulnerabilities

Filters

JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response

JSON API User <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter

JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation