Arni Cinco vulnerabilities

Products

• WPCargo Track & Trace 5
• Subscription Form for Feedblitz 1

Latest Arni Cinco CVEs

Newest publication first

1. CVE-2026-116864 WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability

   Published 2026-10-29

   High·CVSS 7.2 EPSS 0.30%

   Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.

2. CVE-2026-25401 WordPress WPCargo Track & Trace plugin <= 8.0.2 - Broken Access Control vulnerability

   Published 2026-03-25

   High·CVSS 7.5 EPSS 0.30%

   Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.

3. CVE-2025-31745 WordPress Subscription Form for Feedblitz Plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability

   Published 2025-04-01

   Medium·CVSS 6.5 EPSS 0.37%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arni Cinco Subscription Form for Feedblitz feedblitz-email-subscription allows Stored XSS.This issue affects Subscription Form for Feedblitz: from n/a through <= 1.0.9.

4. CVE-2025-31609 WordPress WPCargo Track & Trace plugin <= 8.0.2 - Insecure Direct Object References (IDOR) vulnerability

   Published 2025-03-31

   Medium·CVSS 4.3 EPSS 0.25%

   Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.

5. CVE-2024-54271 WordPress WPCargo Track & Trace plugin <= 8.0.2 - Settings Change vulnerability

   Published 2024-12-13

   Medium·CVSS 5.4 EPSS 0.51%

   Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.

6. CVE-2024-44004 WordPress WPCargo Track & Trace plugin <= 8.0.2 - SQL Injection vulnerability

   Published 2024-09-17

   Critical·CVSS 9.8 EPSS 0.46%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injection. This issue affects WPCargo Track & Trace: before 8.0.4.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.