rafasashi vulnerabilities

Products

• User Session Synchronizer 2
• Custom New User Notification 1
• Language Switcher 1
• SVG Captcha 1
• Todo Custom Field 1

Latest rafasashi CVEs

Newest publication first

1. CVE-2026-15341 User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters

   Published 2026-08-15

   Critical·CVSS 9.8 EPSS 0.59%

   The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The synchronize_session() function, hooked on init and therefore executed on every request, performs no nonce, capabi...

2. CVE-2026-3551 Custom New User Notification <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'User Mail Subject' Setting

   Published 2026-04-16

   Medium·CVSS 4.4 EPSS 0.36%

   The Custom New User Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's admin settings in all versions up to, and including, 1.2.0. This is due to insufficient input sanitization and output escaping on multiple settings fields including...

3. CVE-2025-32612 WordPress User Session Synchronizer plugin <= 1.4.0 - CSRF to Stored XSS vulnerability

   Published 2025-04-09

   High·CVSS 7.1 EPSS 0.19%

   Cross-Site Request Forgery (CSRF) vulnerability in rafasashi User Session Synchronizer user-session-synchronizer allows Stored XSS.This issue affects User Session Synchronizer: from n/a through <= 1.4.0.

4. CVE-2024-49648 WordPress SVG Captcha plugin <= 1.0.11 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2024-10-29

   High·CVSS 7.1 EPSS 0.30%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafasashi SVG Captcha svg-captcha allows Reflected XSS.This issue affects SVG Captcha: from n/a through <= 1.0.11.

5. CVE-2024-49642 WordPress Todo Custom Field plugin <= 3.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2024-10-29

   Medium·CVSS 6.1 EPSS 0.29%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafasashi Todo Custom Field todo-custom-field allows Reflected XSS.This issue affects Todo Custom Field: from n/a through <= 3.0.4.

6. CVE-2024-9610 Language Switcher <= 3.7.13 - Reflected Cross-Site Scripting

   Published 2024-10-11

   Medium·CVSS 6.1 EPSS 0.38%

   The Language Switcher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.7.13. This makes it possible for unauthenticated attackers to inject arbitrar...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.