Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

15 records

Vendor: ValvePress Clear all filters
TI-2025-05650 CVE-2025-6247 · GHSA-wj4r-j458-wpf8

Cross-site scripting in ValvePress WordPress Automatic Plugin

Priority LOW 21

The WordPress Automatic Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.118.0.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00187 Published 2025-08-26 No fix listed CWE-80
TI-2025-26252 CVE-2025-39510 · GHSA-9r4p-w669-7h3m

WordPress Pinterest Automatic Pin plugin < 4.19.0 - SQL Injection vulnerability

Priority MEDIUM 45

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Pinterest Automatic Pin wp-pinterest-automatic allows SQL Injection.This issue affects Pinterest Automatic…

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00305 Published 2025-08-14 No fix listed CWE-89
TI-2025-29218 CVE-2025-46500 · GHSA-v8qm-gjph-4v4j

WordPress Wordpress Auto Spinner plugin <= 3.26.0 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Reflected XSS.This issue affects Wordpress Auto Spinner: from…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00276 Published 2025-07-16 No fix listed CWE-79
TI-2025-26228 CVE-2025-39486 · GHSA-xmm9-247g-g3hq

WordPress Rankie plugin < 1.8.2 - SQL Injection vulnerability

Priority LOW 37

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Rankie valvepress-rankie allows SQL Injection.This issue affects Rankie: from n/a through < 1.8.2.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00302 Published 2025-06-17 No fix listed CWE-89
TI-2025-04847 CVE-2025-5395 · GHSA-v36v-wjrw-5jxg

Unrestricted file upload in ValvePress WordPress Automatic Plugin

Priority MEDIUM 42

The WordPress Automatic Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'core.php' file in all versions up to, and including, 3.115.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00819 Published 2025-06-11 No fix listed CWE-434
TI-2025-26235 CVE-2025-39493 · GHSA-342x-54j8-cm6q

WordPress Rankie plugin < 1.8.2 - Broken Access Control Vulnerability

Priority LOW 38

Missing Authorization vulnerability in ValvePress Rankie valvepress-rankie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rankie: from n/a through < 1.8.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0035 Published 2025-05-16 No fix listed CWE-862
TI-2025-26253 CVE-2025-39511 · GHSA-65xm-c867-m6j9

WordPress Pinterest Automatic Pin plugin <= 4.19.0 - Broken Access Control Vulnerability

Priority LOW 20

Missing Authorization vulnerability in ValvePress Pinterest Automatic Pin wp-pinterest-automatic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinterest Automatic Pin: from n/…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00295 Published 2025-05-16 No fix listed CWE-862
TI-2025-30031 CVE-2025-47534 · GHSA-hp82-hh22-6jg2

WordPress Wordpress Auto Spinner plugin <= 3.25.0 - Broken Access Control Vulnerability

Priority LOW 20

Missing Authorization vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wordpress Auto Spinner: from n/a through…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00295 Published 2025-05-16 No fix listed CWE-862
TI-2024-04511 CVE-2024-4849 · GHSA-c7gm-g64m-839f

WordPress Automatic <= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay Parameter

Priority LOW 28

The WordPress Automatic Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and including, 3.94.0 due to insufficient input sanitization and output…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00274 Published 2024-05-18 No fix listed CWE-79
TI-2021-03237 CVE-2021-4380 · GHSA-mmhw-42fh-v6gr

Pinterest Automatic <= 4.14.3 - Unuathenticated Arbitrary Options Update

Priority MEDIUM 56

The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_request' function and the 'process_form.php' script in versions up…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04491 Published 2023-06-07 No fix listed CWE-284