bmarshall511 vulnerabilities

Products

• bmarshall511/wordpress_zero_spam 1
• Jobify 1
• Zero Spam for WordPress 1

Latest bmarshall511 CVEs

Newest publication first

1. CVE-2026-96752 Zero Spam for WordPress <= 5.7.10 - Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration

   Published 2026-09-25

   High·CVSS 7.2 EPSS 0.24%

   The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration in all versions up to, and including, 5.7.10 due to insufficient input sanitization and output escaping. This makes it possible...

2. CVE-2025-8318 Jobify <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via keyword Parameter

   Published 2025-09-11

   Medium·CVSS 6.4 EPSS 0.25%

   The Jobify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘keyword’ parameter in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-le...

3. CVE-2022-0254 Zero Spam < 5.2.11 - Admin+ SQL Injection

   Published 2022-03-14

   Critical·CVSS 9.8 EPSS 2.0%

   The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.