ValvePress Automatic vulnerabilities

Latest ValvePress Automatic CVEs

Newest publication first

1. CVE-2026-56045 WordPress Automatic plugin < 3.135.1 - Cross Site Scripting (XSS) vulnerability

   Published 2026-06-26

   High·CVSS 7.1 EPSS 0.25%

   Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions.

2. CVE-2024-32693 WordPress Automatic plugin < 3.93.0 - Multiple Cross Site Request Forgery (CSRF) vulnerability

   Published 2024-04-22

   High·CVSS 7.6 EPSS 0.23%

   Cross-Site Request Forgery (CSRF) vulnerability in ValvePress Automatic.This issue affects Automatic: from n/a before 3.93.0.

3. CVE-2024-27956 WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability

   Published 2024-03-21

   Critical·CVSS 9.8 EPSS 94.1% Framework module

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.