LWS vulnerabilities

Products

• LWS Affiliation 2
• LWS Hide Login 2
• LWS Tools 2
• affiliation 1
• LWS Cleaner 1
• LWS Optimize 1

Latest LWS CVEs

Newest publication first

1. CVE-2024-43962 WordPress LWS Affiliation plugin <= 2.3.4 - Broken Access Control vulnerability

   Published 2024-11-01

   High·CVSS 8.8 EPSS 0.46%

   Missing Authorization vulnerability in LWS LWS Affiliation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LWS Affiliation: from n/a through 2.3.4.

2. CVE-2023-47818 WordPress LWS Hide Login plugin <= 2.1.8 - Secret Login Page Location Disclosure on Multisites vulnerability

   Published 2024-06-04

   Low·CVSS 3.7 EPSS 0.30%

   Exposure of Sensitive Information to an Unauthorized Actor vulnerability in LWS LWS Hide Login allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LWS Hide Login: from n/a through 2.1.8.

3. CVE-2023-32297 WordPress LWS Affiliation plugin <= 2.2.6 - Local File Inclusion vulnerability

   Published 2024-05-17

   Critical·CVSS 9.0 EPSS 0.76%

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LWS LWS Affiliation allows PHP Local File Inclusion.This issue affects LWS Affiliation: from n/a through 2.2.6.

4. CVE-2024-30541 WordPress LWS Optimize plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2024-03-31

   Medium·CVSS 4.3 EPSS 0.20%

   Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Optimize.This issue affects LWS Optimize: from n/a through 1.9.1.

5. CVE-2023-27453 WordPress LWS Tools Plugin <= 2.3.1 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-11-22

   High·CVSS 8.8 EPSS 0.30%

   Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.3.1 versions.

6. CVE-2023-34025 WordPress LWS Hide Login Plugin <= 2.1.6 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-11-09

   High·CVSS 8.8 EPSS 0.31%

   Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Hide Login plugin <= 2.1.6 versions.

7. CVE-2023-35774 WordPress LWS Tools Plugin <= 2.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-07-11

   High·CVSS 8.8 EPSS 0.25%

   Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.4.1 versions.

8. CVE-2023-35781 WordPress LWS Cleaner Plugin <= 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-07-11

   High·CVSS 8.8 EPSS 0.25%

   Cross-Site Request Forgery (CSRF) vulnerability in LWS Cleaner plugin <= 2.3.0 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.