Bob vulnerabilities

Products

• Namaste! LMS 6
• Hostel 5
• Watu Quiz 5
• Chained Quiz 2
• Arigato Autoresponder and Newsletter 1
• Likert Survey Master 1

Latest Bob CVEs

Newest publication first

1. CVE-2026-108494 WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-29

   High·CVSS 7.1 EPSS 0.19%

   Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.

2. CVE-2025-68587 WordPress Watu Quiz plugin <= 3.4.5 - Broken Access Control vulnerability

   Published 2025-12-24

   Medium·CVSS 4.3 EPSS 0.22%

   Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz: from n/a through <= 3.4.5.

3. CVE-2023-32120 WordPress Hostel plugin <= 1.1.5.1 - Cross Site Scripting (XSS)

   Published 2025-12-24

   Medium·CVSS 5.9 EPSS 0.20%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bob Hostel allows DOM-Based XSS.This issue affects Hostel: from n/a through 1.1.5.1.

4. CVE-2025-66119 WordPress Hostel plugin <= 1.1.5.9 - Cross Site Scripting (XSS) vulnerability

   Published 2025-12-18

   High·CVSS 7.1 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects Hostel: from n/a through <= 1.1.5.9.

5. CVE-2025-67976 WordPress Watu Quiz plugin <= 3.4.5 - Broken Access Control vulnerability

   Published 2025-12-16

   Medium·CVSS 6.5 EPSS 0.29%

   Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz: from n/a through <= 3.4.5.

6. CVE-2025-53426 WordPress Likert Survey Master plugin <= 0.8.0.1 - Cross Site Scripting (XSS) vulnerability

   Published 2025-10-22

   High·CVSS 7.1 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Likert Survey Master likert-survey-master allows Reflected XSS.This issue affects Likert Survey Master: from n/a through <= 0.8.0.1.

7. CVE-2025-46242 WordPress Watu Quiz plugin <= 3.4.3 - SQL Injection Vulnerability

   Published 2025-04-22

   Medium·CVSS 4.9 EPSS 0.37%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz watu allows SQL Injection.This issue affects Watu Quiz: from n/a through <= 3.4.3.

8. CVE-2025-39594 WordPress Arigato Autoresponder and Newsletter plugin <= 2.7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2025-04-17

   High·CVSS 7.1 EPSS 0.24%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Arigato Autoresponder and Newsletter bft-autoresponder allows Reflected XSS.This issue affects Arigato Autoresponder and Newsletter: from n/a through <= 2.7.2.4.

9. CVE-2025-39566 WordPress Hostel plugin <= 1.1.5.6 - SQL Injection Vulnerability

   Published 2025-04-16

   High·CVSS 7.6 EPSS 0.65%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Hostel hostel allows Blind SQL Injection.This issue affects Hostel: from n/a through <= 1.1.5.6.

10. CVE-2025-30844 WordPress Watu Quiz plugin <= 3.4.2 - Reflected Cross Site Scripting (XSS) Vulnerability

    Published 2025-04-01

    Medium·CVSS 6.1 EPSS 0.40%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Watu Quiz watu allows Reflected XSS.This issue affects Watu Quiz: from n/a through <= 3.4.2.

11. CVE-2025-30848 WordPress Hostel plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 2025-04-01

    High·CVSS 7.1 EPSS 0.32%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects Hostel: from n/a through <= 1.1.5.

12. CVE-2025-31102 WordPress Hostel plugin <= 1.1.5.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 2025-03-28

    High·CVSS 7.1 EPSS 0.23%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects Hostel: from n/a through <= 1.1.5.5.

13. CVE-2025-27353 WordPress Namaste! LMS Plugin <= 2.6.5 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2025-02-24

    Medium·CVSS 4.3 EPSS 0.16%

    Cross-Site Request Forgery (CSRF) vulnerability in Bob Namaste! LMS namaste-lms allows Cross Site Request Forgery.This issue affects Namaste! LMS: from n/a through <= 2.6.5.

14. CVE-2025-24701 WordPress Chained Quiz Plugin <= 1.3.2.9 - Server Side Request Forgery (SSRF) vulnerability

    Published 2025-01-24

    Medium·CVSS 4.4 EPSS 0.34%

    Server-Side Request Forgery (SSRF) vulnerability in Bob Chained Quiz chained-quiz allows Server Side Request Forgery.This issue affects Chained Quiz: from n/a through <= 1.3.2.9.

15. CVE-2024-53809 WordPress Namaste! LMS plugin <= 2.6.4.1 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2024-12-06

    Medium·CVSS 4.3 EPSS 0.18%

    Cross-Site Request Forgery (CSRF) vulnerability in Bob Namaste! LMS namaste-lms allows Cross Site Request Forgery.This issue affects Namaste! LMS: from n/a through <= 2.6.4.1.

16. CVE-2024-53792 WordPress Watu Quiz plugin <= 3.4.1.2 - SQL Injection vulnerability

    Published 2024-12-02

    High·CVSS 8.8 EPSS 0.47%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz watu allows SQL Injection.This issue affects Watu Quiz: from n/a through <= 3.4.1.2.

17. CVE-2024-50407 WordPress Namaste! LMS plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerability

    Published 2024-10-29

    Medium·CVSS 6.1 EPSS 0.33%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Reflected XSS.This issue affects Namaste! LMS: from n/a through <= 2.6.2.

18. CVE-2024-50409 WordPress Namaste! LMS plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerability

    Published 2024-10-29

    Medium·CVSS 5.4 EPSS 0.29%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Stored XSS.This issue affects Namaste! LMS: from n/a through <= 2.6.2.

19. CVE-2024-50410 WordPress Namaste! LMS plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability

    Published 2024-10-29

    Medium·CVSS 5.4 EPSS 0.29%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Stored XSS.This issue affects Namaste! LMS: from n/a through <= 2.6.4.

20. CVE-2024-50408 WordPress Namaste! LMS plugin <= 2.6.3 - PHP Object Injection vulnerability

    Published 2024-10-28

    High·CVSS 8.8 EPSS 0.50%

    Deserialization of Untrusted Data vulnerability in Bob Namaste! LMS namaste-lms allows Object Injection.This issue affects Namaste! LMS: from n/a through <= 2.6.3.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.