Stiofan vulnerabilities

Products

• UsersWP 5
• GetPaid 3
• BlockStrap Page Builder - Bootstrap Blocks 2
• Events Calendar for GeoDirectory 2
• AyeCode Connect 1

Latest Stiofan CVEs

Newest publication first

1. CVE-2026-115609 WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-28

   High·CVSS 7.1 EPSS 0.15%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan GetPaid invoicing allows Stored XSS.This issue affects GetPaid: from n/a through 2.8.62.

2. CVE-2026-94632 WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-09

   High·CVSS 7.1 EPSS 0.18%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Reflected XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a thr...

3. CVE-2026-94641 WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-09

   High·CVSS 7.1 EPSS 0.21%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflected XSS.This issue affects UsersWP: from n/a through 1.2.73.

4. CVE-2026-103086 WordPress UsersWP plugin <= 1.2.74 - Broken Access Control vulnerability

   Published 2026-10-05

   Medium·CVSS 6.5 EPSS 0.23%

   Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74.

5. CVE-2026-39532 WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability

   Published 2026-06-15

   High·CVSS 8.8 EPSS 0.34%

   Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.

6. CVE-2026-49064 WordPress GetPaid plugin <= 2.8.49 - Sensitive Data Exposure vulnerability

   Published 2026-06-15

   High·CVSS 7.5 EPSS 0.24%

   Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve Embedded Sensitive Data. This issue affects GetPaid: from n/a through 2.8.49.

7. CVE-2026-25015 WordPress UsersWP plugin <= 1.2.53 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2026-02-03

   Medium·CVSS 4.3 EPSS 0.14%

   Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.53.

8. CVE-2025-67593 WordPress UsersWP plugin <= 1.2.48 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2025-12-09

   Medium·CVSS 4.3 EPSS 0.13%

   Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.48.

9. CVE-2025-66072 WordPress UsersWP plugin <= 1.2.47 - Broken Access Control vulnerability

   Published 2025-11-21

   Medium·CVSS 5.3 EPSS 0.27%

   Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through <= 1.2.47.

10. CVE-2025-30951 WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.36 - Cross Site Scripting (XSS) Vulnerability

    Published 2025-06-06

    Medium·CVSS 6.5 EPSS 0.27%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Stored XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a throug...

11. CVE-2025-26967 WordPress Events Calendar for GeoDirectory plugin <= 2.3.14 - PHP Object Injection vulnerability

    Published 2025-03-03

    High·CVSS 8.8 EPSS 0.69%

    Deserialization of Untrusted Data vulnerability in Stiofan Events Calendar for GeoDirectory events-for-geodirectory allows Object Injection.This issue affects Events Calendar for GeoDirectory: from n/a through <= 2.3.14.

12. CVE-2024-56255 WordPress AyeCode Connect plugin <= 1.3.8 - Broken Access Control vulnerability

    Published 2025-01-02

    Medium·CVSS 4.3 EPSS 0.29%

    Missing Authorization vulnerability in Stiofan AyeCode Connect ayecode-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AyeCode Connect: from n/a through <= 1.3.8.

13. CVE-2024-43973 WordPress GetPaid plugin <= 2.8.11 - Broken Access Control vulnerability

    Published 2024-11-01

    High·CVSS 8.8 EPSS 0.47%

    Missing Authorization vulnerability in Stiofan GetPaid invoicing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetPaid: from n/a through <= 2.8.11.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.