Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

12 records

Vendor: WPPOOL Clear all filters
TI-2026-83534 CVE-2026-107711 · GHSA-2c44-25vc-hm3p

Stored cross-site scripting in FlexStock WooCommerce plugin

Priority LOW 28

The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'products[].post_content' parameter in all versions up to, and including, 3.…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00342 Published 2026-10-31 No fix listed CWE-79
TI-2026-75155 CVE-2026-93535 · GHSA-cfrj-fqm2-7frv

Stored cross-site scripting in WP Dark Mode WordPress plugin

Priority LOW 27

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attribute in all versions up to, and including, 5.3.17 due…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00152 Published 2026-10-16 No fix listed CWE-79
TI-2026-41316 CVE-2026-57379 · GHSA-xvh5-h92w-xq3x

WordPress FormyChat plugin <= 2.15.3 - Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL FormyChat social-contact-form allows Stored XSS.This issue affects FormyChat: from n/a through <= 2.15.3.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-07-13 No fix listed CWE-79
TI-2025-22035 CVE-2025-30765 · GHSA-r2rj-82xh-h6px

WordPress FlexStock plugin <= 3.13.1 - SQL Injection Vulnerability

Priority LOW 34

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPPOOL FlexStock stock-sync-with-google-sheet-for-woocommerce allows Blind SQL Injection.This issue affects FlexStock:…

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00645 Published 2025-03-27 No fix listed CWE-89
TI-2024-05064 CVE-2024-5449 · GHSA-p826-3x73-p9j2

Missing authorization in WPPOOL WP Dark Mode – Improve Accessibility with AI Powered Dark…

Priority LOW 20

The WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00343 Published 2024-06-06 No fix listed CWE-862
TI-2024-22715 CVE-2024-34375 · GHSA-536w-qc2g-q32f

WordPress Sheets to WP Table Live Sync plugin <= 3.7.0 - Cross Site Scripting (XSS) vulnerability

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Sheets To WP Table Live Sync allows Stored XSS.This issue affects Sheets To WP Table Live Sync: from n/a throug…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00359 Published 2024-05-06 No fix listed CWE-79
TI-2024-20163 CVE-2024-30437 · GHSA-m478-4q3h-f88g

WordPress Webinar and Video Conference with Jitsi Meet plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Webinar and Video Conference with Jitsi Meet allows Stored XSS.This issue affects Webinar and Video Conference…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0036 Published 2024-03-29 No fix listed CWE-79
TI-2023-00442 CVE-2023-0467 · GHSA-mrr5-9q84-93pr

WP Dark Mode < 4.0.8 - Subscriber+ Local File Inclusion

Priority MEDIUM 53

The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00678 Published 2023-03-27 Fixed in 4.0.8 CWE-22
TI-2022-04310 CVE-2022-4714 · GHSA-jpv9-4v9p-758r

WP Dark Mode < 4.0.0 - Contributor+ Stored XSS in Shortcode

Priority MEDIUM 58

The WP Dark Mode WordPress plugin before 4.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00457 Published 2023-02-21 Fixed in 4.0.0