captivateaudio vulnerabilities

Products

• Captivate Sync 4

Latest captivateaudio CVEs

Newest publication first

1. CVE-2026-62060 WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability

   Published 2026-10-01

   High·CVSS 7.6 EPSS 0.23%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through 3.3.2.

2. CVE-2025-68570 WordPress Captivate Sync plugin <= 3.2.2 - SQL Injection vulnerability

   Published 2025-12-24

   High·CVSS 7.6 EPSS 0.33%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through <= 3.2.2.

3. CVE-2025-60221 WordPress Captivate Sync Plugin <= 3.0.3 - PHP Object Injection Vulnerability

   Published 2025-10-22

   Critical·CVSS 9.8 EPSS 0.58%

   Deserialization of Untrusted Data vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Object Injection.This issue affects Captivate Sync: from n/a through <= 3.0.3.

4. CVE-2024-53820 WordPress Captivate Sync plugin <= 2.0.22 - Cross Site Scripting (XSS) vulnerability

   Published 2024-12-06

   Medium·CVSS 6.5 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Stored XSS.This issue affects Captivate Sync: from n/a through <= 2.0.22.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.