mg12 vulnerabilities

Products

• wp-recentcomments 3
• Mobile Themes 1
• WP-EasyArchives 1

Latest mg12 CVEs

Newest publication first

1. CVE-2025-49345 WordPress WP-EasyArchives plugin <= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2025-12-31

   High·CVSS 7.1 EPSS 0.11%

   Cross-Site Request Forgery (CSRF) vulnerability in mg12 WP-EasyArchives wp-easyarchives allows Stored XSS.This issue affects WP-EasyArchives: from n/a through <= 3.1.2.

2. CVE-2025-28881 WordPress Mobile Themes plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2025-03-11

   Medium·CVSS 4.3 EPSS 0.17%

   Cross-Site Request Forgery (CSRF) vulnerability in mg12 Mobile Themes wp-mobile-themes allows Cross Site Request Forgery.This issue affects Mobile Themes: from n/a through <= 1.1.1.

3. CVE-2023-23886 WordPress WP-RecentComments plugin <= 2.2.7 - Broken Access Control vulnerability

   Published 2024-12-09

   Medium·CVSS 5.4 EPSS 0.59%

   Missing Authorization vulnerability in mg12 WP-RecentComments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-RecentComments: from n/a through 2.2.7.

4. CVE-2012-1067 WP-RecentComments <= 2.0.7 - SQL Injection

   Published 2012-02-14

   High·CVSS 7.5 EPSS 2.0%

   SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solel...

5. CVE-2012-1068 WP-RecentComments <= 2.0.6 - Cross-Site Scripting

   Published 2012-02-14

   Medium·CVSS 4.3 EPSS 2.1%

   Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.