Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: WP Experts Clear all filters
TI-2024-12933 CVE-2024-13914 · GHSA-7chh-jrvc-3cqw

Path traversal in WP Experts File Manager Advanced Shortcode

Priority LOW 35

The File Manager Advanced Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.4 (file-manager-advanced-shortcode) and 2.5.6 (advanced-file-manager-pro-premium),…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00895 Published 2025-05-15 No fix listed CWE-22
TI-2023-02941 CVE-2023-3139 · GHSA-xr6q-qcgj-7prg

Protect WP Admin < 4.0 - Unauthenticated Protection Bypass

Priority MEDIUM 60

The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00734 Published 2023-07-04 Fixed in 4.0 CWE-601
TI-2022-01583 CVE-2022-1717 · GHSA-j4c9-5ppc-wh72

Custom Share Buttons with Floating Sidebar < 4.2 - Admin+ Stored XSS

Priority LOW 23

The Custom Share Buttons with Floating Sidebar WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting at…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00588 Published 2022-06-20 Fixed in 4.2 CWE-79
TI-2022-00779 CVE-2022-0874 · GHSA-w376-4pjj-5fm9

WP Social Buttons <= 2.1 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The WP Social Buttons WordPress plugin through 2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability i…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-05-09 No fix listed CWE-79
TI-2021-07186 CVE-2021-24906 · GHSA-vfmc-6gqf-r52m

Protect WP Admin < 3.6.2 - Unauthenticated Plugin Deactivation

Priority LOW 36

The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin (and therefore the protection offered)…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01489 Published 2022-01-24 Fixed in 3.6.2 CWE-862