MediumCVSS 5.3
EPSS 0.33%
Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.
Vendor
wpkube vulnerabilities
21 published CVES affecting wpkube, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 21
- Critical
- 1
- High
- 3
- Medium
- 17
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
- Authors List 5
- Simple Basic Contact Form 4
- Cool Tag Cloud 3
- Subscribe To Comments Reloaded 3
- kiwi social share 2
- Social Sharing Plugin – Kiwi 2
- about author box 1
- CAPTCHA 4WP 1
- CAPTCHA 4WP – Antispam CAPTCHA solution for WordPress 1
- Kiwi 1
- Subscribe To Comments Reloaded (WordPress plugin) 1
Latest wpkube CVEs
Newest publication first
-
-
MediumCVSS 6.5 EPSS 0.23%
The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leaked secret key and usage of a weak hash generation algorithm in all versions up to, and including, 240119. This makes it possible for unauthenticated attackers t...
-
CVE-2025-69011 WordPress Cool Tag Cloud plugin <= 2.29 - Cross Site Scripting (XSS) vulnerability
PublishedMediumCVSS 6.5 EPSS 0.19%Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Cool Tag Cloud cool-tag-cloud allows Stored XSS.This issue affects Cool Tag Cloud: from n/a through <= 2.29.
-
CVE-2025-13614 Cool Tag Cloud <= 2.29 - Authenticated (Contributor+) Stored Cross-Site Scripting
PublishedHighCVSS 8.1 EPSS 0.37%The Cool Tag Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cool_tag_cloud' shortcode in all versions up to, and including, 2.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...
-
MediumCVSS 6.5 EPSS 0.41%
The Authors List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.6.1 via the via arbitrary method call from Authors_List_Shortcode class. This makes it possible for authenticated attackers, with Contributor-level acce...
-
MediumCVSS 4.3 EPSS 0.14%
Cross-Site Request Forgery (CSRF) vulnerability in WPKube Authors List authors-list allows Cross Site Request Forgery.This issue affects Authors List: from n/a through <= 2.0.6.2.
-
MediumCVSS 6.5 EPSS 0.21%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Kiwi kiwi-social-share allows Stored XSS.This issue affects Kiwi: from n/a through <= 2.1.8.
-
MediumCVSS 4.8 EPSS 0.33%
The Simple Basic Contact Form WordPress plugin before 20250114 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for exampl...
-
MediumCVSS 6.5 EPSS 0.38%
The The Authors List plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it...
-
HighCVSS 7.3 EPSS 0.58%
The The Authors List plugin for WordPress is vulnerable to arbitrary shortcode execution via update_authors_list_ajax AJAX action in all versions up to, and including, 2.0.4. This is due to the software allowing users to execute an action that does not properly validate a value b...
-
MediumCVSS 6.3 EPSS 0.44%
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in...
-
MediumCVSS 5.3 EPSS 0.41%
The Social Sharing Plugin – Kiwi plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.7 via the 'kiwi-nw-pinterest' class. This makes it possible for unauthenticated attackers to view limited content from password protected posts.
-
CVE-2024-4144 Simple Basic Contact Form <= 20240502 - Unauthenticated Arbitrary Shortcode Execution
PublishedMediumCVSS 6.5 EPSS 0.66%The Simple Basic Contact Form plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 20240502. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on the fu...
-
MediumCVSS 6.1 EPSS 0.51%
The Simple Basic Contact Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘scf_email’ parameter in versions up to, and including, 20221201 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attac...
-
HighCVSS 7.5 EPSS 0.51%
Insertion of Sensitive Information into Log File vulnerability in WPKube Subscribe To Comments Reloaded.This issue affects Subscribe To Comments Reloaded: from n/a through 220725.
-
CVE-2023-37981 WordPress Authors List Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)
PublishedMediumCVSS 6.1 EPSS 0.38%Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPKube Authors List plugin <= 2.0.2 versions.
-
CriticalCVSS 9.8 EPSS 1.4%
The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi_social_share_get_option() function called via the kiwi_social_share_get_option AJAX action in version 2.1.0. This makes it possible for unauthenticated a...
-
MediumCVSS 4.8 EPSS 0.56%
The Simple Basic Contact Form WordPress plugin before 20221201 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for exampl...
-
MediumCVSS 5.4 EPSS 0.39%
Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress allows attackers to clean up Log archive, download system info file, plugin system settings, plugin options settings, generate a new key, rese...
-
MediumCVSS 5.4 EPSS 0.62%
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks.
-
MediumCVSS 5.4 EPSS 0.65%
The Cool Tag Cloud WordPress plugin before 2.26 does not escape the style attribute of the cool_tag_cloud shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.