krishaweb vulnerabilities

Products

• Add Multiple Marker 1
• Advance Nav Menu Manager 1
• contact form 7 email add on 1
• Email addon for CF7 1
• Multi Location Marker 1

Latest krishaweb CVEs

Newest publication first

1. CVE-2026-8688 Advance Nav Menu Manager <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Nav Menu Item Modification via anmm_save_menu_data AJAX Action

   Published 2026-06-24

   Medium·CVSS 4.3 EPSS 0.39%

   The Advance Nav Menu Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,...

2. CVE-2025-11999 Add Multiple Marker <= 1.2 - Missing Authorization to Unauthenticated Settings Update

   Published 2025-11-11

   Medium·CVSS 5.3 EPSS 0.29%

   The Add Multiple Marker plugin for WordPress is vulnerable to unauthorized modification of data to due to a missing capability check on the addmultiplemarker_reset_map() and amm_save_map_api() functions in all versions up to, and including, 1.2. This makes it possible for unauthe...

3. CVE-2024-10898 Contact Form 7 Email Add on <= 1.9 - Authenticated (Contributor+) Local File Inclusion

   Published 2024-11-21

   High·CVSS 8.8 EPSS 1.3%

   The Contact Form 7 Email Add on plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the cf7_email_add_on_add_admin_template() function. This makes it possible for authenticated attackers, with Contributor-level access and above...

4. CVE-2022-45080 WordPress Add Multiple Marker Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-04-23

   High·CVSS 8.8 EPSS 0.26%

   Cross-Site Request Forgery (CSRF) vulnerability in KrishaWeb Add Multiple Marker plugin <= 1.2 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.