johnbillion vulnerabilities

Products

• johnbillion/wp-crontrol 2
• WP Crontrol 2
• johnbillion/query-monitor 1
• Query Monitor 1

Latest johnbillion CVEs

Newest publication first

1. CVE-2026-4267 Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI

   Published 2026-03-31

   High·CVSS 7.2 EPSS 0.31%

   The Query Monitor – The developer tools panel for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘$_SERVER['REQUEST_URI']’ parameter in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping. Th...

2. CVE-2025-8678 WP Crontrol - 1.17.0 - 1.19.1 - Authenticated (Administrator+) Blind Server-Side Request Forgery

   Published 2025-08-22

   Medium·CVSS 5.9 EPSS 0.39%

   The WP Crontrol plugin for WordPress is vulnerable to blind Server-Side Request Forgery in versions 1.17.0 to 1.19.1 via the 'wp_remote_request' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitr...

3. CVE-2024-28850 WP Crontrol possible RCE when combined with a pre-condition

   Published 2024-03-25

   High·CVSS 8.2 EPSS 0.17%

   WP Crontrol controls the cron events on WordPress websites. WP Crontrol includes a feature that allows administrative users to create events in the WP-Cron system that store and execute PHP code subject to the restrictive security permissions documented here. While there is no kn...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.