india-web-developer vulnerabilities

Products

• Login with OTP 2
• SEO Manager 1
• WP Youtube Gallery 1

Latest india-web-developer CVEs

Newest publication first

1. CVE-2026-8760 Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force

   Published 2026-05-27

   Critical·CVSS 9.8 EPSS 1.0%

   The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for CVE-2024-11178: the rate-limit/lockout check added to otpl_login_action() was placed only inside the OTP-generation branc...

2. CVE-2024-12590 WP Youtube Gallery <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

   Published 2025-01-07

   Medium·CVSS 6.4 EPSS 0.28%

   The WP Youtube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contribut...

3. CVE-2024-11178 Login With OTP <= 1.4.2 - Authentication Bypass via Weak OTP

   Published 2024-12-06

   High·CVSS 8.1 EPSS 0.65%

   The Login With OTP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.4.2. This is due to the plugin generating too weak OTP, and there’s no attempt or time limit. This makes it possible for unauthenticated attackers to generate and br...

4. CVE-2024-9521 SEO Manager <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta

   Published 2024-10-16

   Medium·CVSS 6.4 EPSS 0.28%

   The SEO Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with co...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.