goback2 vulnerabilities

Products

• salavat counter Plugin 2
• Logo Manager For Enamad 1

Latest goback2 CVEs

Newest publication first

1. CVE-2026-6549 Logo Manager For Enamad <= 0.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute

   Published 2026-05-20

   Medium·CVSS 6.4 EPSS 0.25%

   The Logo Manager For Enamad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute of the vc_enamad_namad, vc_enamad_shamed, and vc_enamad_custom shortcodes in all versions up to, and including, 0.7.4 due to insufficient input sanitization and...

2. CVE-2026-1047 salavat counter Plugin <= 0.9.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'image_url' Parameter

   Published 2026-02-19

   Medium·CVSS 4.4 EPSS 0.35%

   The salavat counter Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'image_url' parameter in all versions up to, and including, 0.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, w...

3. CVE-2024-11435 salavat counter Plugin <= 0.9.4 - Reflected Cross-Site Scripting

   Published 2024-11-21

   Medium·CVSS 6.1 EPSS 0.58%

   The salavat counter Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 0.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.