10up vulnerabilities

Products

• Safe SVG 6
• ElasticPress 4
• 10up/distributor 3
• Restricted Site Access 3
• Simple Local Avatars 3
• Eight Day Week Print Workflow 2
• Autoshare for Twitter 1
• Microsoft Azure Storage for WordPress 1
• Simple Page Ordering 1

Latest 10up CVEs

Newest publication first

1. CVE-2026-111631 Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions

   Published 2026-10-16

   Medium·CVSS 5.3 EPSS 0.24%

   Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection with a chosen endpointId and url to send stor...

2. CVE-2026-111628 10up Distributor before 2.3.2 PHP Object Injection via set_meta()

   Published 2026-10-16

   Low·CVSS 2.3 EPSS 0.27%

   10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php un...

3. CVE-2026-111625 10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action

   Published 2026-10-16

   Medium·CVSS 5.3 EPSS 0.25%

   10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or pub...

4. CVE-2026-110227 WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability

   Published 2026-10-14

   Medium·CVSS 5.3 EPSS 0.24%

   Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2.

5. CVE-2026-94672 WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability

   Published 2026-09-30

   Medium·CVSS 4.3 EPSS 0.21%

   Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.

6. CVE-2026-94077 WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

   Published 2026-09-30

   Medium·CVSS 6.5 EPSS 0.17%

   Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.

7. CVE-2026-62088 WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability

   Published 2026-09-11

   Medium·CVSS 5.3 EPSS 0.33%

   Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4.

8. CVE-2026-5028 Eight Day Week Print Workflow <= 1.2.6 - Authenticated (Subscriber+) SQL Injection via 'title' Parameter

   Published 2026-05-12

   Medium·CVSS 6.5 EPSS 0.24%

   The Eight Day Week Print Workflow plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'title' parameter in the pp-get-articles AJAX action in all versions up to, and including, 1.2.6. This is due to insufficient escaping on the user supplied parameter and...

9. CVE-2026-25311 WordPress Autoshare for Twitter plugin <= 2.3.1 - Broken Access Control vulnerability

   Published 2026-02-19

   Medium·CVSS 5.4 EPSS 0.24%

   Missing Authorization vulnerability in 10up Autoshare for Twitter autoshare-for-twitter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoshare for Twitter: from n/a through <= 2.3.1.

10. CVE-2025-67621 WordPress Eight Day Week Print Workflow plugin <= 1.2.5 - Sensitive Data Exposure vulnerability

    Published 2025-12-24

    Medium·CVSS 4.3 EPSS 0.26%

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in 10up Eight Day Week Print Workflow eight-day-week-print-workflow allows Retrieve Embedded Sensitive Data.This issue affects Eight Day Week Print Workflow: from n/a through <= 1.2.5.

11. CVE-2025-10749 Microsoft Azure Storage for WordPress <= 4.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion

    Published 2025-10-24

    Medium·CVSS 5.4 EPSS 0.27%

    The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5.1. This is due to missing capability checks on the 'azure-storage-media-replace' AJAX action. This makes it possible for...

12. CVE-2025-8482 Simple Local Avatars <= 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Avatar Migration

    Published 2025-08-12

    Medium·CVSS 4.3 EPSS 0.28%

    The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of data in version 2.8.4. This is due to a missing capability check on the migrate_from_wp_user_avatar() function. This makes it possible for authenticated attackers, with subscriber-level ac...

13. CVE-2023-32798 WordPress Simple Page Ordering plugin <= 2.5.0 - Broken Access Control vulnerability

    Published 2024-12-13

    Medium·CVSS 5.3 EPSS 0.56%

    Missing Authorization vulnerability in 10up Simple Page Ordering allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Page Ordering: from n/a through 2.5.0.

14. CVE-2024-10786 Simple Local Avatars <= 2.7.11 - Missing Authorization to Authenticated (Subscriber+) User Cache Clearing

    Published 2024-11-16

    Medium·CVSS 4.3 EPSS 0.34%

    The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the sla_clear_user_cache function in all versions up to, and including, 2.7.11. This makes it possible for authenticated attackers, with Subscriber...

15. CVE-2024-8378 Safe SVG < 2.2.6 - Author+ SVG Sanitisation Bypass

    Published 2024-11-07

    Medium·CVSS 4.8 EPSS 0.33%

    The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for example for code that uses wp_handle_sideload which is often used to upload attachments via raw POST data.

16. CVE-2024-43116 WordPress Simple Local Avatars plugin <= 2.7.10 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2024-08-26

    High·CVSS 8.8 EPSS 0.21%

    Cross-Site Request Forgery (CSRF) vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.10.

17. CVE-2024-35684 WordPress ElasticPress plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2024-06-08

    Medium·CVSS 4.3 EPSS 0.19%

    Cross-Site Request Forgery (CSRF) vulnerability in 10up ElasticPress elasticpress.This issue affects ElasticPress: from n/a through <= 5.1.1.

18. CVE-2023-48753 WordPress Restricted Site Access plugin <= 7.4.1 - IP Restriction Bypass vulnerability

    Published 2024-06-04

    Medium·CVSS 5.3 EPSS 0.35%

    Authentication Bypass by Spoofing vulnerability in 10up Restricted Site Access allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Restricted Site Access: from n/a through 7.4.1.

19. CVE-2021-4405 ElasticPress <= 3.5.3 - Cross-Site Request Forgery Bypass

    Published 2023-07-01

    Medium·CVSS 4.3 EPSS 0.39%

    The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to missing or incorrect nonce validation on the epio_send_autosuggest_allowed() function. This makes it possible for unauthenticated attackers to...

20. CVE-2022-1613 Restricted Site Access < 7.3.2 - Access Bypass via IP Spoofing

    Published 2022-09-26

    Medium·CVSS 5.3 EPSS 0.73%

    The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations in certain situations.

21. CVE-2022-1091 Safe SVG < 1.9.10 - SVG Sanitisation Bypass

    Published 2022-04-18

    Medium·CVSS 6.1 EPSS 1.2%

    The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly...

22. CVE-2019-18854 Safe SVG <= 1.9.4 - Denial of Service

    Published 2019-11-11

    High·CVSS 7.5 EPSS 2.6%

    A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ... xlink:href="#identifier">' substring.

23. CVE-2019-18855 Safe SVG <= 1.9.4 - Denial of Service

    Published 2019-11-11

    High·CVSS 7.5 EPSS 2.6%

    A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributes.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.