Vulnerabilities

TI-2025-07332 CVE-2025-8013 · GHSA-gm42-w748-rgww

Quttera Web Malware Scanner <= 3.5.1.41 - Authenticated (Administrator+) Server-Side Request Forgery

LOW 18

The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.5.1.41 via the 'RunExternalScan' function.

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.003 Published 2025-08-15 No fix listed CWE-918

TI-2023-05583 CVE-2023-6065 · GHSA-g9xh-cc3h-8ghx

Quttera Web Malware Scanner < 3.4.2.1 - Directory Listing to Sensitive Data Exposure

MEDIUM 42

The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.18552 Published 2023-12-18 Fixed in 3.4.2.1

TI-2023-05715 CVE-2023-6222 · GHSA-jgjj-g58w-4hp3

Quttera Web Malware Scanner < 3.4.2.1 - Admin+ Path Traversal

HIGH 67

IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01061 Published 2023-12-18 Fixed in 3.4.2.1 CWE-22

Vulnerabilities

Filters

Quttera Web Malware Scanner <= 3.5.1.41 - Authenticated (Administrator+) Server-Side Request Forgery

Quttera Web Malware Scanner < 3.4.2.1 - Directory Listing to Sensitive Data Exposure

Quttera Web Malware Scanner < 3.4.2.1 - Admin+ Path Traversal