Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: rafasashi Clear all filters
TI-2026-12911 CVE-2026-15341 · GHSA-r26j-82cg-5h6c

Improper authentication in rafasashi User Session Synchronizer

Priority MEDIUM 50

The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00585 Published 2026-08-15 No fix listed CWE-287
TI-2026-03061 CVE-2026-3551 · GHSA-4xx2-h7jh-g7ph

Cross-site scripting in rafasashi Custom New User Notification

Priority LOW 20

The Custom New User Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's admin settings in all versions up to, and including, 1.2.0.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00361 Published 2026-04-16 No fix listed CWE-79
TI-2024-33128 CVE-2024-49642 · GHSA-wr39-ggxq-3pf9

WordPress Todo Custom Field plugin <= 3.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafasashi Todo Custom Field todo-custom-field allows Reflected XSS.This issue affects Todo Custom Field: from n/a thro…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00288 Published 2024-10-29 No fix listed CWE-79
TI-2024-08915 CVE-2024-9610 · GHSA-5c6j-q7qx-jw7p

Language Switcher <= 3.7.13 - Reflected Cross-Site Scripting

Priority LOW 27

The Language Switcher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.7.13.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00375 Published 2024-10-11 No fix listed CWE-79