Toast Plugins vulnerabilities

Products

• Animator 3
• Internal Link Optimiser 3
• Sticky Anything 2
• Toast Mobile Menu 1

Latest Toast Plugins CVEs

Newest publication first

1. CVE-2026-66464 WordPress Internal Link Optimiser plugin <= 5.2.7 - Broken Access Control vulnerability

   Published 2026-08-13

   Medium·CVSS 6.5 EPSS 0.27%

   Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.

2. CVE-2025-53238 WordPress Toast Mobile Menu plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

   Published 2025-10-22

   High·CVSS 7.1 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Toast Mobile Menu toast-responsive-menu allows Stored XSS.This issue affects Toast Mobile Menu: from n/a through <= 1.0.8.

3. CVE-2025-54039 WordPress Animator plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) Vulnerability

   Published 2025-07-16

   Medium·CVSS 4.3 EPSS 0.15%

   Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Animator scroll-triggered-animations allows Cross Site Request Forgery.This issue affects Animator: from n/a through <= 3.0.16.

4. CVE-2025-39547 WordPress Internal Link Optimiser plugin <= 5.1.3 - CSRF to XSS vulnerability

   Published 2025-04-16

   High·CVSS 7.1 EPSS 0.19%

   Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Internal Link Optimiser internal-link-finder allows Stored XSS.This issue affects Internal Link Optimiser: from n/a through <= 5.1.3.

5. CVE-2025-32243 WordPress Internal Link Optimiser plugin <= 5.1.2 - Settings Change vulnerability

   Published 2025-04-10

   Medium·CVSS 6.5 EPSS 0.32%

   Missing Authorization vulnerability in Toast Plugins Internal Link Optimiser internal-link-finder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Internal Link Optimiser: from n/a through <= 5.1.2.

6. CVE-2023-47689 WordPress Animator plugin <= 3.0.10 - Unauthenticated Plugin Settings Change Vulnerability

   Published 2025-01-02

   Medium·CVSS 6.5 EPSS 0.41%

   Missing Authorization vulnerability in Toast Plugins Animator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animator: from n/a through 3.0.10.

7. CVE-2024-49308 WordPress Animator – Scroll Triggered Animations plugin <= 3.0.15 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2024-10-17

   High·CVSS 7.1 EPSS 0.29%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Animator scroll-triggered-animations allows Reflected XSS.This issue affects Animator: from n/a through <= 3.0.15.

8. CVE-2024-33646 WordPress Sticky Anything plugin <= 2.1.5 - Broken Access Control to XSS vulnerability

   Published 2024-04-29

   High·CVSS 7.1 EPSS 0.18%

   Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Sticky Anything allows Cross-Site Scripting (XSS).This issue affects Sticky Anything: from n/a through 2.1.5.

9. CVE-2024-30551 WordPress Sticky Anything plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

   Published 2024-03-31

   High·CVSS 7.1 EPSS 0.33%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Sticky Anything.This issue affects Sticky Anything: from n/a through 2.1.5.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.