Vulnerabilities

TI-2026-22505 CVE-2026-28165 · GHSA-9fm9-353f-f726

WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability

MEDIUM 49

Unauthenticated Privilege Escalation in Digits <= 9.2 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00483 Published 2026-08-24 No fix listed CWE-266

TI-2026-11583 CVE-2026-13741 · GHSA-9xxr-jm2h-93xc

Improper privilege management in UnitedOver Digits: WordPress Mobile Number Signup and…

MEDIUM 40

The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.1.0.5.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00442 Published 2026-07-16 No fix listed CWE-269

TI-2025-03634 CVE-2025-4094 · GHSA-vr5w-fmp9-m564

Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing

MEDIUM 59

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.16566 Published 2025-05-21 Fixed in 8.4.6.1

TI-2024-00184 CVE-2024-0203 · GHSA-g295-36ch-j742

Cross-site request forgery in UnitedOver Digits: WordPress Mobile Number Signup and Login

MEDIUM 40

The Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.1.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00273 Published 2024-03-07 No fix listed CWE-352

Vulnerabilities

Filters

WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability

Improper privilege management in UnitedOver Digits: WordPress Mobile Number Signup and…

Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing

Cross-site request forgery in UnitedOver Digits: WordPress Mobile Number Signup and Login