HighCVSS 7.7
EPSS 0.44%
Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.
Vendor
PeepSo vulnerabilities
22 published CVES affecting PeepSo, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 22
- Critical
- 0
- High
- 7
- Medium
- 15
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
- PeepSo 14
- Community by PeepSo 6
- Community by PeepSo – Download from PeepSo.com 5
- Community by PeepSo – Social Network, Membership, Registration, User Profiles 5
- Download Community by PeepSo 1
- PeepSo Core: File Uploads 1
- PeepSo Core: Groups 1
Latest PeepSo CVEs
Newest publication first
-
-
CVE-2026-66668 WordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerability
PublishedHighCVSS 8.5 EPSS 0.36%Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.
-
MediumCVSS 6.4 EPSS 0.24%
The PeepSo Core: Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Group Description field in all versions up to, and including, 6.4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
-
MediumCVSS 5.3 EPSS 0.30%
The PeepSo Core: File Uploads plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.6.0 via the file_download REST API endpoint due to missing validation on a user controlled key. This makes it possible for unauthenticate...
-
MediumCVSS 6.1 EPSS 0.60%
The Community by PeepSo – Download from PeepSo.com plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘filter’ parameter in all versions up to, and including, 7.0.3.0 due to insufficient input sanitization and output escaping. This makes it possible for...
-
MediumCVSS 5.4 EPSS 0.28%
The Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URLs in posts, comments, and profiles when Markdown support is enabled in all versions up to, and includin...
-
MediumCVSS 5.3 EPSS 0.45%
The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.6.0. This is due to the plugin displaying errors and allowing direct access to the sse.php file....
-
MediumCVSS 4.8 EPSS 0.34%
The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 6.4.5.0 due to insufficient input sanitization and output escaping...
-
MediumCVSS 4.8 EPSS 0.34%
The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for...
-
MediumCVSS 4.3 EPSS 0.18%
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepSo: from n/a through 6.3.1.1.
-
MediumCVSS 5.3 EPSS 0.44%
Insertion of Sensitive Information into Log File vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepSo: from n/a through 6.2.7.0.
-
CVE-2023-27630 WordPress Community by PeepSo plugin <= 6.0.9.0 - Server Information Disclosure
PublishedMediumCVSS 5.3 EPSS 0.51%Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepSo: from n/a through 6.0.9.0.
-
MediumCVSS 5.4 EPSS 0.32%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Stored XSS.This issue affects Community by PeepSo – Social Network, Membership, Regist...
-
MediumCVSS 4.3 EPSS 0.24%
The Community by PeepSo WordPress plugin before 6.3.1.2 does not have CSRF check when creating a user post (visible on their wall in their profile page), which could allow attackers to make logged in users perform such action via a CSRF attack
-
MediumCVSS 6.1 EPSS 0.52%
The Community by PeepSo WordPress plugin before 6.3.1.2 does not sanitise and escape various parameters and generated URLs before outputting them back attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
-
MediumCVSS 6.1 EPSS 0.41%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Reflected XSS.This issue affects Community by PeepSo – Social Network, Membership, Reg...
-
MediumCVSS 5.4 EPSS 0.39%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Stored XSS.This issue affects Community by PeepSo – Social Network, Membership, Regist...
-
HighCVSS 8.8 EPSS 0.25%
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Download Community by PeepSo plugin <= 6.1.6.0 versions.
-
HighCVSS 8.8 EPSS 0.34%
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.9.0 versions.
-
HighCVSS 8.8 EPSS 0.26%
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo plugin <= 6.0.2.0 versions.
-
HighCVSS 8.8 EPSS 0.25%
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.2.0 versions.
-
HighCVSS 8.8 EPSS 1.6%
The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.