Vulnerabilities

TI-2025-31316 CVE-2025-49268 · GHSA-pvp2-4qqp-rvh5

WordPress Verge3D plugin <= 4.9.4 - Broken Access Control Vulnerability

LOW 30

Missing Authorization vulnerability in Soft8Soft LLC Verge3D verge3d allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Verge3D: from n/a through <= 4.9.4.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00355 Published 2025-06-06 No fix listed CWE-862

TI-2025-30567 CVE-2025-48241 · GHSA-w4q4-qqj7-r6q8

WordPress Verge3D plugin <= 4.9.3 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D verge3d allows Reflected XSS.This issue affects Verge3D: from n/a through <= 4.9.3.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00227 Published 2025-05-23 No fix listed CWE-79

TI-2025-26185 CVE-2025-39443 · GHSA-gh9p-r2h3-q5rr

WordPress Verge3D plugin <= 4.9.0 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in Soft8Soft LLC Verge3D verge3d allows Cross Site Request Forgery.This issue affects Verge3D: from n/a through <= 4.9.0.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00168 Published 2025-04-17 No fix listed CWE-352

TI-2025-22103 CVE-2025-30833 · GHSA-8w7v-wg9w-c7jm

WordPress Verge3D Publishing and E-Commerce Plugin <= 4.8.2 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in Soft8Soft LLC Verge3D verge3d allows Cross Site Request Forgery.This issue affects Verge3D: from n/a through <= 4.8.2.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00213 Published 2025-03-27 No fix listed CWE-352

TI-2025-16591 CVE-2025-22709 · GHSA-x2vh-h2v5-9rrm

WordPress Verge3D Publishing and E-Commerce Plugin <= 4.8.0 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D verge3d allows Reflected XSS.This issue affects Verge3D: from n/a through <= 4.8.0.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00266 Published 2025-01-21 No fix listed CWE-79

TI-2023-28075 CVE-2023-51421 · GHSA-m4vm-4pp6-pqj9

WordPress Verge3D Plugin <= 4.5.2 is vulnerable to Arbitrary File Upload

MEDIUM 44

Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00594 Published 2023-12-29 No fix listed CWE-434

TI-2023-28074 CVE-2023-51420 · GHSA-jjxg-ww3w-m6hq

WordPress Verge3D Plugin <= 4.5.2 is vulnerable to Remote Code Execution (RCE)

MEDIUM 42

Improper Control of Generation of Code ('Code Injection') vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00579 Published 2023-12-29 No fix listed CWE-94