Vulnerabilities

TI-2026-07831 CVE-2026-8910 · GHSA-3wxc-x4qv-3xxg

WP Emoticon Rating <= 1.0.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting via 'emo_settings' Parameter

LOW 26

The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0012 Published 2026-06-09 No fix listed CWE-352

TI-2026-07830 CVE-2026-8909 · GHSA-5xqj-g46w-c5mr

WpMobi <= 0.0.3 - Cross-Site Request Forgery via save_general_settings Action

LOW 19

The WpMobi plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.3.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00128 Published 2026-06-09 No fix listed CWE-352

TI-2026-07829 CVE-2026-8907 · GHSA-vq77-9gmh-wxx2

WP-Ultimate-Map <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'zoom-level' Parameter

LOW 26

The WP-Ultimate-Map plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00119 Published 2026-06-09 No fix listed CWE-352

TI-2026-07828 CVE-2026-8906 · GHSA-rg3q-ffcx-mq26

WP Promoter <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup_width' Parameter

LOW 26

The WP Promoter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00119 Published 2026-05-27 No fix listed CWE-352

TI-2026-07925 CVE-2026-9014 · GHSA-j5qh-rj6w-86m8

WP Promoter <= 1.3 - Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Action

LOW 30

The WP Promoter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_stats() function in versions up to, and including, 1.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00268 Published 2026-05-27 No fix listed CWE-862

Vulnerabilities

Filters

WP Emoticon Rating <= 1.0.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting via 'emo_settings' Parameter

WpMobi <= 0.0.3 - Cross-Site Request Forgery via save_general_settings Action

WP-Ultimate-Map <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'zoom-level' Parameter

WP Promoter <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup_width' Parameter

WP Promoter <= 1.3 - Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Action