pootlepress vulnerabilities

Products

• Caxton – Create Pro page layouts in Gutenberg 2
• pootle button 2
• Pootle Pagebuilder – WordPress Page builder 2
• easy smooth scroll links 1
• Easy Smooth Scroll Links – Smooth Scrolling Anchor 1
• Mobile Pages 1

Latest pootlepress CVEs

Newest publication first

1. CVE-2025-32625 WordPress Mobile Blocks Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2025-04-17

   High·CVSS 7.1 EPSS 0.32%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pootlepress Mobile Pages mobile-pages allows Reflected XSS.This issue affects Mobile Pages: from n/a through <= 1.0.2.

2. CVE-2025-23758 WordPress pootle button plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2025-01-22

   High·CVSS 7.1 EPSS 0.40%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pootlepress Pootle button pootle-button allows Reflected XSS.This issue affects Pootle button: from n/a through <= 1.2.0.

3. CVE-2022-4974 Freemius SDK <= 2.4.2 - Missing Authorization Checks

   Published 2024-10-16

   Medium·CVSS 6.3 EPSS 0.44%

   The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in...

4. CVE-2024-37948 WordPress Caxton – Create Pro page layouts in Gutenberg plugin <= 1.30.1 - Cross Site Scripting (XSS) vulnerability

   Published 2024-07-20

   Medium·CVSS 6.5 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PootlePress Caxton – Create Pro page layouts in Gutenberg allows Stored XSS.This issue affects Caxton – Create Pro page layouts in Gutenberg: from n/a through 1.30.1.

5. CVE-2024-34573 WordPress Pootle Pagebuilder plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability

   Published 2024-05-08

   Medium·CVSS 6.5 EPSS 0.31%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pootlepress Pootle Pagebuilder – WordPress Page builder allows Stored XSS.This issue affects Pootle Pagebuilder – WordPress Page builder: from n/a through 5.7.1.

6. CVE-2022-0728 Easy Smooth Scroll Links < 2.23.1 - Admin+ Stored Cross-Site Scripting

   Published 2022-04-11

   Medium·CVSS 4.8 EPSS 0.60%

   The Easy Smooth Scroll Links WordPress plugin before 2.23.1 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

7. CVE-2017-15811 pootle button <= 1.1.1 - Reflected Cross-Site Scripting

   Published 2017-10-23

   Medium·CVSS 5.4 EPSS 0.97%

   The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.