Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: videousermanuals Clear all filters
TI-2026-10266 CVE-2026-11898 · GHSA-68vf-fpc6-h9j4

White Label CMS <= 2.7.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import Settings

Priority LOW 21

The White Label CMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.7.12 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00397 Published 2026-07-11 No fix listed CWE-79
TI-2024-03984 CVE-2024-4280 · GHSA-m2qx-r5jq-8pfw

White Label CMS <= 2.7.3 - Missing Authorization to Plugin Settings Reset

Priority LOW 24

The White Label CMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_plugin function in all versions up to, and including, 2.7.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00422 Published 2024-05-10 No fix listed CWE-862
TI-2022-03940 CVE-2022-4302 · GHSA-4mqj-332f-2459

White Label CMS < 2.5 - Admin+ PHP Object Injection

Priority HIGH 67

The White Label CMS WordPress plugin before 2.5 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.17686 Published 2023-01-02 Fixed in 2.5
TI-2022-00346 CVE-2022-0422 · GHSA-r6cx-xcr7-w88v

White Label MS < 2.2.9 - Reflected Cross-Site Scripting

Priority LOW 38

The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripti…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.08084 Published 2022-03-07 Fixed in 2.2.9 CWE-79
TI-2012-04561 CVE-2012-5388 · GHSA-73gm-693r-4g36

Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS…

Priority LOW 23

Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_nam…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.039 Published 2012-10-24 No fix listed CWE-79