softpulseinfotech vulnerabilities

Products

• SP Blog Designer 3
• Picsmize 1

Latest softpulseinfotech CVEs

Newest publication first

1. CVE-2026-4859 SP Blog Designer <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'design' Attribute

   Published 2026-05-12

   Medium·CVSS 6.4 EPSS 0.19%

   The SP Blog Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'design' attribute of the wpsbd_post_carousel shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible fo...

2. CVE-2025-31606 WordPress SP Blog Designer plugin <= 1.0.0 - Arbitrary Shortcode Execution vulnerability

   Published 2025-03-31

   Medium·CVSS 4.8 EPSS 0.21%

   Missing Authorization vulnerability in softpulseinfotech SP Blog Designer sp-blog-designer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SP Blog Designer: from n/a through <= 1.0.0.

3. CVE-2024-52498 WordPress SP Blog Designer plugin <= 1.0.0 - Local File Inclusion vulnerability

   Published 2024-11-28

   High·CVSS 7.5 EPSS 0.64%

   Path Traversal: '.../...//' vulnerability in softpulseinfotech SP Blog Designer sp-blog-designer allows PHP Local File Inclusion.This issue affects SP Blog Designer: from n/a through <= 1.0.0.

4. CVE-2024-52380 WordPress Picsmize plugin <= 1.0.0 - Arbitrary File Upload vulnerability

   Published 2024-11-14

   Critical·CVSS 10.0 EPSS 1.6%

   Unrestricted Upload of File with Dangerous Type vulnerability in softpulseinfotech Picsmize picsmize allows Upload a Web Shell to a Web Server.This issue affects Picsmize: from n/a through <= 1.0.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.