Vulnerabilities

TI-2025-35997 CVE-2025-58192 · GHSA-78g5-fq4q-8f3p

WordPress WP Bulk Delete Plugin <= 1.3.6 - Broken Access Control Vulnerability

LOW 24

Missing Authorization vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bulk Delete: from n/a through <= 1.3.6.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00179 Published 2025-08-27 No fix listed CWE-862

TI-2025-29950 CVE-2025-47453 · GHSA-qw6m-wwcp-hjpw

WordPress WP Smart Import plugin <= 1.1.3 - Local File Inclusion Vulnerability

MEDIUM 44

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Xylus Themes WP Smart Import wp-smart-import allows PHP Local File Inclusion.This issue affects WP…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00737 Published 2025-05-23 No fix listed CWE-98

TI-2025-30582 CVE-2025-48256 · GHSA-m3r9-g8hh-v79g

WordPress Import Social Events plugin <= 1.8.5 - Cross Site Scripting (XSS) Vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes Import Social Events import-facebook-events allows Stored XSS.This issue affects Import Social Events: fr…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00271 Published 2025-05-19 No fix listed CWE-79

TI-2025-30028 CVE-2025-47531 · GHSA-jxrv-m7f3-wm3w

WordPress XT Event Widget for Social Events plugin <= 1.1.7 - Local File Inclusion Vulnerability

MEDIUM 41

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Xylus Themes XT Event Widget for Social Events xt-facebook-events allows PHP Local File Inclusion.T…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00701 Published 2025-05-07 No fix listed CWE-98

TI-2025-18417 CVE-2025-24700 · GHSA-rx5c-wxq4-wp76

WordPress WP Event Aggregator Plugin <= 1.8.2 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator wp-event-aggregator allows Reflected XSS.This issue affects WP Event Aggregator: from…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00255 Published 2025-02-14 No fix listed CWE-79

TI-2024-31670 CVE-2024-47352 · GHSA-3j6w-wcmf-ph6c

WordPress WP Bulk Delete plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Stored XSS.This issue affects WP Bulk Delete: from n/a through <= 1.…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00287 Published 2024-10-06 No fix listed CWE-79

TI-2024-25937 CVE-2024-38703 · GHSA-3c73-87fp-87pp

WordPress WP Event Aggregator plugin <= 1.7.9 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator allows Stored XSS.This issue affects WP Event Aggregator: from n/a through 1.7…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00269 Published 2024-07-20 No fix listed CWE-79

TI-2024-21484 CVE-2024-32597 · GHSA-v4hx-5qgp-299x

WordPress WP Smart Import plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WordPress Importer allows Stored XSS.This issue affects WordPress Importer: from n/a through 1.0.7.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00314 Published 2024-04-18 No fix listed CWE-79

TI-2024-20743 CVE-2024-31371 · GHSA-6pwm-9g9r-9xr7

WordPress WP Event Aggregator plugin <= 1.7.6 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in Xylus Themes WP Event Aggregator.This issue affects WP Event Aggregator: from n/a through 1.7.6.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.002 Published 2024-04-12 No fix listed CWE-352

TI-2024-19947 CVE-2024-30201 · GHSA-5486-77xm-7wvf

WordPress WP Smart Import plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WordPress Importer allows Reflected XSS.This issue affects WordPress Importer: from n/a through 1.0.4.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00397 Published 2024-03-27 No fix listed CWE-79

TI-2022-19075 CVE-2022-40209 · GHSA-p5w8-5f33-gggw

WP Smart Import plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

LOW 28

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xylus Themes WP Smart Import plugin <= 1.0.2 on WordPress.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00433 Published 2022-12-06 No fix listed CWE-79

TI-2020-14817 CVE-2020-24147 · GHSA-96g2-x6h6-v7h9

Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import)…

MEDIUM 42

Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01612 Published 2021-07-07 No fix listed CWE-918

Vulnerabilities

Filters