CoSchedule vulnerabilities

Products

• CoSchedule 3
• Headline Analyzer 3

Latest CoSchedule CVEs

Newest publication first

1. CVE-2025-62974 WordPress Headline Analyzer plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

   Published 2025-10-27

   Medium·CVSS 6.5 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CoSchedule Headline Analyzer headline-analyzer allows Stored XSS.This issue affects Headline Analyzer: from n/a through <= 1.3.7.

2. CVE-2025-49913 WordPress CoSchedule plugin <= 3.4.0 - Broken Access Control vulnerability

   Published 2025-10-22

   Medium·CVSS 5.3 EPSS 0.35%

   Missing Authorization vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoSchedule: from n/a through <= 3.4.0.

3. CVE-2025-60119 WordPress CoSchedule Plugin <= 3.3.11 - Sensitive Data Exposure Vulnerability

   Published 2025-09-26

   Medium·CVSS 5.3 EPSS 0.31%

   Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Retrieve Embedded Sensitive Data.This issue affects CoSchedule: from n/a through <= 3.3.11.

4. CVE-2023-46195 WordPress Headline Analyzer plugin <= 1.3.1 - Broken Access Control vulnerability

   Published 2025-01-02

   Medium·CVSS 6.5 EPSS 0.39%

   Missing Authorization vulnerability in CoSchedule Headline Analyzer headline-analyzer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Headline Analyzer: from n/a through <= 1.3.1.

5. CVE-2024-32806 WordPress Headline Analyzer plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2024-04-24

   Medium·CVSS 4.3 EPSS 0.20%

   Cross-Site Request Forgery (CSRF) vulnerability in CoSchedule Headline Analyzer.This issue affects Headline Analyzer: from n/a through 1.3.3.

6. CVE-2022-47165 WordPress CoSchedule Plugin <= 3.3.8 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-05-25

   High·CVSS 8.8 EPSS 0.25%

   Cross-Site Request Forgery (CSRF) vulnerability in CoSchedule plugin <= 3.3.8 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.