wp easy post types project vulnerabilities

Products

• wp easy post types 3

Latest wp easy post types project CVEs

Newest publication first

1. CVE-2024-10079 WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) PHP Object Injection

   Published 2024-10-18

   High·CVSS 8.8 EPSS 0.81%

   The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserialization of untrusted input from the 'text' parameter in the 'ajax_import_content' function. This allows authenticated attackers, with subscriber-l...

2. CVE-2024-10078 WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions

   Published 2024-10-18

   Medium·CVSS 5.4 EPSS 0.41%

   The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with subscribe...

3. CVE-2014-4524 WP Easy Post Types < 1.4.4 - Cross-Site Scripting

   Published 2014-07-02

   Medium·CVSS 4.3 EPSS 2.0%

   Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ref parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.