kiboit vulnerabilities

Products

• PhastPress 3

Latest kiboit CVEs

Newest publication first

1. CVE-2026-3712 PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter

   Published 2026-10-15

   High·CVSS 7.3 EPSS 0.24%

   The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possib...

2. CVE-2025-14388 PhastPress <= 3.7 - Unauthenticated Arbitrary File Read via Null Byte Injection

   Published 2025-12-23

   Critical·CVSS 9.8 EPSS 0.48%

   The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in getExtensionForURL() which operates on URL-decoded paths, a...

3. CVE-2021-24210 PhastPress < 1.111 - Open Redirect

   Published 2021-04-05

   Medium·CVSS 6.1 EPSS 3.1%

   There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the plugin and then redirect the victim to a malicious page. There is also a support comment from another user one year ago (https://wordpress.org...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.