10up ElasticPress vulnerabilities

Latest 10up ElasticPress CVEs

Newest publication first

1. CVE-2026-62088 WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability

   Published 2026-09-11

   Medium·CVSS 5.3 EPSS 0.33%

   Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4.

2. CVE-2024-35684 WordPress ElasticPress plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2024-06-08

   Medium·CVSS 4.3 EPSS 0.19%

   Cross-Site Request Forgery (CSRF) vulnerability in 10up ElasticPress elasticpress.This issue affects ElasticPress: from n/a through <= 5.1.1.

3. CVE-2023-48753 WordPress Restricted Site Access plugin <= 7.4.1 - IP Restriction Bypass vulnerability

   Published 2024-06-04

   Medium·CVSS 5.3 EPSS 0.35%

   Authentication Bypass by Spoofing vulnerability in 10up Restricted Site Access allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Restricted Site Access: from n/a through 7.4.1.

4. CVE-2021-4405 ElasticPress <= 3.5.3 - Cross-Site Request Forgery Bypass

   Published 2023-07-01

   Medium·CVSS 4.3 EPSS 0.39%

   The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to missing or incorrect nonce validation on the epio_send_autosuggest_allowed() function. This makes it possible for unauthenticated attackers to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.