Vulnerabilities

TI-2023-11241 CVE-2023-25997 · GHSA-f5m3-4m73-89p9

WordPress Sola Support Ticket <= 3.17 - Arbitrary Content Deletion Vulnerability

LOW 29

Missing Authorization vulnerability in SolaPlugins Sola Support Ticket allows Exploiting Incorrectly Configured Access Control Security Levels.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00339 Published 2025-06-06 No fix listed CWE-862

TI-2024-08477 CVE-2024-9127 · GHSA-wj25-rxgg-p3g9

Super Testimonials <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter

LOW 28

The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alignment’ parameter in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escapin…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00349 Published 2024-09-26 No fix listed CWE-79

TI-2024-25606 CVE-2024-38345 · GHSA-cmgf-649f-vw86

Cross-site request forgery in Sola Testimonials

LOW 37

A cross-site request forgery vulnerability exists in Sola Testimonials versions prior to 3.0.0.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00252 Published 2024-07-04 Fixed in 3.0.0 CWE-352

TI-2024-25605 CVE-2024-38344 · GHSA-jvmf-76g5-h4gv

Cross-site request forgery in Sola Plugins WP Tweet Walls

LOW 24

A cross-site request forgery vulnerability exists in WP Tweet Walls versions prior to 1.0.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00256 Published 2024-07-04 Fixed in 1.0.4 CWE-352

TI-2021-13648 CVE-2021-34634 · GHSA-qv96-733j-36x6

Nifty Newsletters <= 4.0.23 - Cross-Site Request Forgery to Stored Cross-Site Scripting

LOW 39

The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the sola_nl_wp_head function found in the ~/sola-newsletters.php file which allows attackers to inject arbitrary web scripts, in vers…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.007 Published 2021-08-05 No fix listed CWE-352

TI-2016-09050 CVE-2016-11012 · GHSA-vw5v-4c4j-8g4q

The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.

LOW 26

The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00783 Published 2019-09-20 No fix listed CWE-79

Vulnerabilities

Filters

WordPress Sola Support Ticket <= 3.17 - Arbitrary Content Deletion Vulnerability

Super Testimonials <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter

Cross-site request forgery in Sola Testimonials

Cross-site request forgery in Sola Plugins WP Tweet Walls

Nifty Newsletters <= 4.0.23 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.