pagup vulnerabilities

Products

• Automatic Internal Links for SEO by Pagup 3
• Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) 3
• WP Google Street View (with 360° virtual tour) & Google maps + Local SEO 3
• Ads.txt & App-ads.txt Manager for WordPress 2
• Add Linkedin insight tags for Linkedin ads 1
• Add Pinterest conversion tags for Pinterest Ads + Site verification 1
• Add Tiktok Pixel for Tiktok ads (+Woocommerce) 1
• Add Twitter Pixel for Twitter ads 1
• Auto SEO META keywords (META tags keywords) optimization + WooCommerce 1
• better robots.txt 1
• Better Robots.txt – AI-Ready Crawl Control & Bot Governance 1
• Bulk Auto Image Title Attribute 1
• Bulk Auto Image Title Attribute (Image Title tag) optimizer (Image SEO) 1
• MOBILOOK — Mobile View & Mobile‑Friendly Test 1
• VidSEO – Video transcript embedding for WordPress & LLM 1
• WordPress Robots.txt optimization 1
• WP Google Street View 1

Latest pagup CVEs

Newest publication first

1. CVE-2024-13362 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

   Published 2026-05-01

   Medium·CVSS 6.1 EPSS 0.28%

   Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

2. CVE-2026-0563 WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' Shortcode

   Published 2026-01-09

   Medium·CVSS 6.4 EPSS 0.22%

   The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpgsv_map' shortcode in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. Thi...

3. CVE-2025-15019 BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

   Published 2026-01-09

   Medium·CVSS 6.4 EPSS 0.21%

   The BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bialty_cs_alt' post meta in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output...

4. CVE-2025-62921 WordPress Bulk Auto Image Title Attribute plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

   Published 2025-10-27

   Medium·CVSS 6.5 EPSS 0.20%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup Bulk Auto Image Title Attribute bulk-image-title-attribute allows DOM-Based XSS.This issue affects Bulk Auto Image Title Attribute: from n/a through <= 2.0.1.

5. CVE-2025-30799 WordPress WP Google Street View plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerability

   Published 2025-03-27

   Medium·CVSS 5.9 EPSS 0.35%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup WP Google Street View wp-google-street-view allows Stored XSS.This issue affects WP Google Street View: from n/a through <= 1.1.5.

6. CVE-2024-13542 WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

   Published 2025-01-24

   Medium·CVSS 5.4 EPSS 0.25%

   The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgsv' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping...

7. CVE-2024-11009 Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) <= 1.2.1 - Authenticated (Administrator+) SQL Injection via post_id Parameter

   Published 2024-11-27

   Medium·CVSS 4.9 EPSS 0.44%

   The Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘post_id’ parameter in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter...

8. CVE-2024-50415 WordPress Ads.txt & App-ads.txt Manager for WordPress plugin <= 1.1.7.1 - Stored Cross Site Scripting (XSS) vulnerability

   Published 2024-10-29

   Medium·CVSS 5.9 EPSS 0.27%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup Ads.txt & App-ads.txt Manager for WordPress app-ads-txt allows Stored XSS.This issue affects Ads.txt & App-ads.txt Manager for WordPress: from n/a through <= 1.1.7.1.

9. CVE-2022-4974 Freemius SDK <= 2.4.2 - Missing Authorization Checks

   Published 2024-10-16

   Medium·CVSS 6.3 EPSS 0.44%

   The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in...

10. CVE-2023-25706 WordPress Robots.txt optimization plugin <= 1.4.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Published 2023-07-11

    Medium·CVSS 6.5 EPSS 0.22%

    Cross-Site Request Forgery (CSRF) vulnerability in Pagup WordPress Robots.Txt optimization plugin <= 1.4.5 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.