ilGhera vulnerabilities

Products

• JW Player for WordPress 3
• Woocommerce Support System 2
• mailup auto subscription 1
• Related Videos for JW Player 1

Latest ilGhera CVEs

Newest publication first

1. CVE-2026-93512 WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability

   Published 2026-09-30

   High·CVSS 7.1 EPSS 0.18%

   Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.

2. CVE-2026-39614 WordPress JW Player for WordPress plugin <= 2.3.6 - Broken Access Control vulnerability

   Published 2026-04-08

   Medium·CVSS 5.4 EPSS 0.17%

   Missing Authorization vulnerability in ilGhera JW Player for WordPress jw-player-7-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JW Player for WordPress: from n/a through <= 2.3.6.

3. CVE-2025-32516 WordPress Related Videos for JW Player plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2025-04-17

   High·CVSS 7.1 EPSS 0.30%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ilGhera Related Videos for JW Player related-videos-for-jw-player allows Reflected XSS.This issue affects Related Videos for JW Player: from n/a through <= 1.2.0.

4. CVE-2024-13521 MailUp Auto Subscription <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

   Published 2025-01-28

   Medium·CVSS 5.4 EPSS 0.14%

   The MailUp Auto Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the mas_options function. This makes it possible for unauthenticated attackers to upd...

5. CVE-2023-41686 WordPress Woocommerce Support System plugin <= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2024-12-13

   Medium·CVSS 6.5 EPSS 0.32%

   Cross-Site Request Forgery (CSRF) vulnerability in ilGhera Woocommerce Support System allows Cross Site Request Forgery.This issue affects Woocommerce Support System: from n/a through 1.2.2.

6. CVE-2024-33931 WordPress JW Player for WordPress plugin <= 2.3.3 - Broken Access Control vulnerability

   Published 2024-05-03

   Medium·CVSS 6.5 EPSS 0.43%

   Missing Authorization vulnerability in ilGhera JW Player for WordPress.This issue affects JW Player for WordPress: from n/a through 2.3.3.

7. CVE-2023-41685 WordPress Woocommerce Support System Plugin <= 1.2.1 is vulnerable to SQL Injection

   Published 2023-11-06

   Critical·CVSS 9.8 EPSS 0.68%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ilGhera Woocommerce Support System allows SQL Injection.This issue affects Woocommerce Support System: from n/a through 1.2.1.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.