TI-2026-10273 CVE-2026-11907 · GHSA-vq9h-6p44-rphw
Missing authorization in xwp Stream – Activity Log & Audit Trail
Priority LOW 29
The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0.
Vulnerabilities
7 records
TI-2024-12900 CVE-2024-13879 · GHSA-fjjc-v9rc-xhj8
Stream <= 4.0.2 - Authenticated (Admin+) Server-Side Request Forgery
Priority LOW 25
The Stream plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.2 due to insufficient validation on the webhook feature.
TI-2024-06879 CVE-2024-7423 · GHSA-6f2c-7wmp-gmrf
Stream <= 4.0.1 - Cross-Site Request Forgery to Arbitrary Options Update
Priority MEDIUM 40
The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1.
TI-2022-21242 CVE-2022-43450 · GHSA-3j4h-62vw-5645
WordPress Stream Plugin <= 3.9.2 is vulnerable to Insecure Direct Object References (IDOR)
Priority LOW 30
Authorization Bypass Through User-Controlled Key vulnerability in XWP Stream.This issue affects Stream: from n/a through 3.9.2.
TI-2022-21279 CVE-2022-43490 · GHSA-fcr6-wjf5-jw82
WordPress Stream Plugin <= 3.9.2 is vulnerable to Cross Site Request Forgery (CSRF)
Priority LOW 38
Cross-Site Request Forgery (CSRF) vulnerability in XWP Stream plugin <= 3.9.2 versions.
TI-2022-04015 CVE-2022-4384 · GHSA-frh4-4pfg-65vw
Stream < 3.9.2 - Subscriber+ Alert Creation
Priority MEDIUM 62
The Stream WordPress plugin before 3.9.2 does not prevent users with little privileges on the site (like subscribers) from using its alert creation functionality, which may enable them to leak sensitive information.
TI-2021-07054 CVE-2021-24772 · GHSA-8h59-r32p-w7w3
Stream < 3.8.2 - Admin+ SQL Injection
Priority MEDIUM 41
The Stream WordPress plugin before 3.8.2 does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statement, leading to an SQL injection issue.