Vulnerabilities

TI-2026-03123 CVE-2026-3620 · GHSA-px2q-qrrj-jj65

Word Replacer <= 0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Replacement' Parameter

LOW 20

The Word Replacer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replacement' parameter in all versions up to, and including, 0.4.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00246 Published 2026-06-02 No fix listed CWE-20

TI-2024-11799 CVE-2024-12726 · GHSA-g453-c6fq-7fg3

ClipArt <= 0.2 - Reflected XSS

MEDIUM 60

The ClipArt WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such a…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0034 Published 2025-05-15 No fix listed CWE-79

TI-2025-21892 CVE-2025-30617 · GHSA-xg53-rgc9-jmqc

WordPress Rewrite plugin <= 0.2.1 - Cross Site Request Forgery (CSRF) Vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in takien Rewrite rewrite allows Cross Site Request Forgery.This issue affects Rewrite: from n/a through <= 0.2.1.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00184 Published 2025-03-24 No fix listed CWE-352

Vulnerabilities

Filters

Word Replacer <= 0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Replacement' Parameter

ClipArt <= 0.2 - Reflected XSS

WordPress Rewrite plugin <= 0.2.1 - Cross Site Request Forgery (CSRF) Vulnerability