Vulnerabilities

TI-2025-16677 CVE-2025-22796 · GHSA-3xq6-2gcp-f92p

WordPress WP-Asambleas Plugin <= 2.85.0 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in platcom WP-Asambleas wp-asambleas allows Reflected XSS.This issue affects WP-Asambleas: from n/a through <= 2.85.0.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00293 Published 2025-04-17 No fix listed CWE-79

TI-2025-20141 CVE-2025-27294 · GHSA-h7xh-jqw8-mhx8

WordPress WP-Asambleas plugin <= 2.85.0 - Arbitrary Shortcode Execution vulnerability

LOW 22

Missing Authorization vulnerability in platcom WP-Asambleas wp-asambleas allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Asambleas: from n/a through <= 2.85.0.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00264 Published 2025-02-24 No fix listed CWE-862

TI-2024-12620 CVE-2024-13579 · GHSA-7vj4-x7gh-427c

WP-Asambleas <= 2.85.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 28

The WP-Asambleas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'polls_popup' shortcode in all versions up to, and including, 2.85.0 due to insufficient input sanitization and output e…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00246 Published 2025-02-18 No fix listed CWE-79

Vulnerabilities

Filters

WordPress WP-Asambleas Plugin <= 2.85.0 - Reflected Cross Site Scripting (XSS) vulnerability

WordPress WP-Asambleas plugin <= 2.85.0 - Arbitrary Shortcode Execution vulnerability

WP-Asambleas <= 2.85.0 - Authenticated (Contributor+) Stored Cross-Site Scripting