Vulnerabilities

TI-2025-43913 CVE-2025-9373 · GHSA-x77m-jvpm-6cv8

Stored cross-site scripting in PeproDev Branches Map plugin

LOW 28

The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00245 Published 2026-10-14 No fix listed CWE-79

TI-2026-70134 CVE-2026-4791 · GHSA-7c69-582w-m4jr

Stored cross-site scripting in PeproDev Ultimate Profile Solutions

LOW 28

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficie…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00185 Published 2026-10-10 No fix listed CWE-79

TI-2025-03467 CVE-2025-3921 · GHSA-m6r5-4fc9-xqjx

Improper authorization in PeproDev Ultimate Profile Solutions

MEDIUM 42

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handel_ajax_req() function in versions 1.9.1 to 7.5.2.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00457 Published 2025-05-07 No fix listed CWE-285

TI-2025-03470 CVE-2025-3924 · GHSA-gx79-p29g-9rqw

PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Unauthenticated Email Enumeration

LOW 30

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized access of data via its publicly exposed reset-password endpoint.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00383 Published 2025-05-07 No fix listed CWE-285

TI-2025-03394 CVE-2025-3844 · GHSA-5v6f-j8c4-h52p

PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Authentication Bypass to Account Takeover

MEDIUM 50

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Authentication Bypass in versions 1.9.1 to 7.5.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00641 Published 2025-05-07 No fix listed CWE-288

TI-2024-12758 CVE-2024-13719 · GHSA-c7vr-vpm2-822g

PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure

LOW 31

The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00477 Published 2025-02-19 No fix listed CWE-862

TI-2024-08239 CVE-2024-8873 · GHSA-qhq6-88r3-4vr4

PeproDev WooCommerce Receipt Uploader <= 2.6.9 - Reflected Cross-Site Scripting

LOW 28

The PeproDev WooCommerce Receipt Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including,…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00509 Published 2024-11-16 No fix listed CWE-79

TI-2024-17033 CVE-2024-25933 · GHSA-4gc8-g785-gxxw

WordPress PeproDev Ultimate Invoice plugin <= 1.9.7 - Sensitive Data Exposure vulnerability

LOW 39

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pepro Dev.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00453 Published 2024-03-17 No fix listed CWE-200

TI-2023-22256 CVE-2023-41863 · GHSA-3p7v-r2rf-xx9x

WordPress PeproDev CF7 Database Plugin <= 1.7.0 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Pepro Dev.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00382 Published 2023-09-25 No fix listed CWE-79

Vulnerabilities

Filters