Vulnerabilities

TI-2026-19775 CVE-2026-24535 · GHSA-vppq-872c-9pgj

WordPress Automatic Featured Images from Videos plugin <= 1.2.7 - Broken Access Control vulnerability

LOW 20

Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00239 Published 2026-01-23 No fix listed CWE-862

TI-2025-12844 CVE-2025-14056 · GHSA-gx74-2mp6-xwmq

Custom Post Type UI <= 1.18.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'label' Import Parameter

LOW 20

The Custom Post Type UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'label' parameter during custom post type import in all versions up to, and including, 1.18.1 due to insufficient input sa…

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00295 Published 2025-12-13 No fix listed CWE-79

TI-2025-11749 CVE-2025-12826 · GHSA-p4vc-pp2h-cfvh

Missing authorization in webdevstudios Custom Post Type UI

LOW 22

The Custom Post Type UI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.18.0.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00326 Published 2025-12-04 No fix listed CWE-862

TI-2025-30471 CVE-2025-48101 · GHSA-p67f-q4xm-7jg2

WordPress Constant Contact for WordPress Plugin <= 4.1.1 - PHP Object Injection Vulnerability

MEDIUM 40

Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00327 Published 2025-09-09 No fix listed CWE-502

TI-2025-22957 CVE-2025-31820 · GHSA-ghpr-7v2r-qpx3

WordPress Automatic Featured Images from Videos plugin <= 1.2.4 - Broken Access Control vulnerability

LOW 20

Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00333 Published 2025-04-01 No fix listed CWE-862

TI-2015-08048 CVE-2015-10120 · GHSA-95jr-m2m4-mc9m

WDS Multisite Aggregate Plugin WDS_Multisite_Aggregate_Options.php update_options cross site scripting

LOW 28

A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPress.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00546 Published 2023-07-10 No fix listed CWE-79

TI-2023-01527 CVE-2023-1623 · GHSA-q4v4-hpcx-wf3x

Custom Post Type UI < 1.13.5 - Debug Info Sending via CSRF

MEDIUM 62

The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplied email, which could allow attackers to make a logged in admin send such informa…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00352 Published 2023-04-24 Fixed in 1.13.5

TI-2015-07941 CVE-2015-10013 · GHSA-xxpq-f82j-29cp

WebDevStudios taxonomy-switcher Plugin taxonomy-switcher.php taxonomy_switcher_init cross site scripting

LOW 28

A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00694 Published 2023-01-05 No fix listed CWE-79

TI-2015-07750 CVE-2015-9373 · GHSA-mvxm-4jmc-9pmr

PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

LOW 29

PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0095 Published 2019-08-28 No fix listed CWE-79

Vulnerabilities

Filters