Really Simple Plugins vulnerabilities

Products

• Really Simple SSL 7
• Recipe Maker For Your Food Blog from Zip Recipes 3
• Complianz 2
• Complianz Premium 2
• Really Simple Security Pro 2
• Burst Statistics Pro 1
• Really Simple Security Pro multisite 1

Latest Really Simple Plugins CVEs

Newest publication first

1. CVE-2026-84777 WordPress Really Simple SSL plugin <= 9.8.0 - 2FA Bypass vulnerability

   Published 2026-09-03

   High·CVSS 7.4

   Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.

2. CVE-2026-84775 WordPress Really Simple SSL plugin <= 9.8.0 - Denial of Service Attack vulnerability

   Published 2026-09-02

   Medium·CVSS 5.3

   Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.

3. CVE-2026-48970 WordPress Really Simple SSL plugin <= 9.5.10 - Broken Authentication vulnerability

   Published 2026-06-15

   High·CVSS 8.1 EPSS 0.39%

   Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions.

4. CVE-2026-48969 WordPress Really Simple SSL plugin <= 9.5.9 - Broken Access Control vulnerability

   Published 2026-06-15

   Medium·CVSS 6.5 EPSS 0.26%

   Subscriber Broken Access Control in Really Simple SSL <= 9.5.9 versions.

5. CVE-2026-27397 WordPress Really Simple Security Pro plugin <= 9.5.4.0 - Insecure Direct Object References (IDOR) vulnerability

   Published 2026-03-19

   Medium·CVSS 6.5

   Authorization Bypass Through User-Controlled Key vulnerability in Really Simple Plugins B.V. Really Simple Security Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple Security Pro: from n/a through 9.5.4.0.

6. CVE-2026-32461 WordPress Really Simple SSL plugin <= 9.5.7 - Broken Access Control vulnerability

   Published 2026-03-13

   Medium·CVSS 4.3

   Missing Authorization vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple SSL: from n/a through <= 9.5.7.

7. CVE-2025-24623 WordPress Really Simple Security plugin <= 9.1.4 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2025-01-24

   Medium·CVSS 4.3

   Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Cross Site Request Forgery.This issue affects Really Simple SSL: from n/a through <= 9.1.4.

8. CVE-2024-10924 Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

   Published 2024-11-15

   Critical·CVSS 9.8 EPSS 82.2% Framework module

   The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function....

9. CVE-2024-31229 WordPress Really Simple SSL plugin <= 7.2.3 - Server Side Request Forgery (SSRF) vulnerability

   Published 2024-04-18

   Medium·CVSS 5.5

   Server-Side Request Forgery (SSRF) vulnerability in Really Simple Plugins Really Simple SSL.This issue affects Really Simple SSL: from n/a through 7.2.3.

10. CVE-2023-52180 WordPress Recipe Maker For Your Food Blog from Zip Recipes Plugin <= 8.1.0 is vulnerable to SQL Injection

    Published 2023-12-31

    High·CVSS 8.1

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes.This issue affects Recipe Maker For Your Food Blog from Zip Recipes: from n/a through 8.1.0.

11. CVE-2023-5761 Burst Statistics – Privacy-Friendly Analytics for WordPress 1.4.0 to 1.4.6.1 - Unauthenticated SQL Injection

    Published 2023-12-07

    High·CVSS 7.5

    The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter in versions 1.4.0 to 1.4.6.1 (free) and versions 1.4.0 to 1.5.0 (pro) due to insufficient escaping on the user supplied parameter and lack o...

12. CVE-2023-33333 WordPress Complianz and Complianz Premium plugins - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS)

    Published 2023-11-30

    High·CVSS 8.8

    Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Premium allows Cross-Site Scripting (XSS).This issue affects Complianz: from n/a through 6.4.4; Complianz Premium: from n/a through 6.4.6.1.

13. CVE-2023-34030 WordPress Complianz and Complianz Premium plugins - Cross Site Request Forgery (CSRF)

    Published 2023-11-30

    High·CVSS 8.8

    Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Premium allows Cross-Site Request Forgery.This issue affects Complianz: from n/a through 6.4.5; Complianz Premium: from n/a through 6.4.7.

14. CVE-2023-31076 WordPress Recipe Maker For Your Food Blog from Zip Recipes Plugin <= 8.0.6 is vulnerable to Cross Site Scripting (XSS)

    Published 2023-08-17

    Medium·CVSS 6.1

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.0.6 versions.

15. CVE-2023-35089 WordPress Recipe Maker For Your Food Blog from Zip Recipes Plugin <= 8.0.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Published 2023-07-17

    High·CVSS 8.8

    Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.0.7 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.