yydevelopment vulnerabilities

Products

• Advanced 301 and 302 Redirect 1
• Back To The Top Button 1
• Mobile Contact Line 1
• Page & Post Notes 1

Latest yydevelopment CVEs

Newest publication first

1. CVE-2026-49067 WordPress Advanced 301 and 302 Redirect plugin <= 1.6.9 - SQL Injection vulnerability

   Published 2026-06-15

   Critical·CVSS 9.3

   Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions.

2. CVE-2025-12527 Page & Post Notes <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Note Update/Deletion

   Published 2025-11-07

   Medium·CVSS 4.3

   The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the 'yydev_notes_save_dashboard_data' function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with...

3. CVE-2025-58622 WordPress Mobile Contact Line Plugin <= 2.4.0 - Broken Access Control Vulnerability

   Published 2025-09-03

   Medium·CVSS 4.3

   Missing Authorization vulnerability in yydevelopment Mobile Contact Line mobile-contact-line allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile Contact Line: from n/a through <= 2.4.0.

4. CVE-2023-41733 WordPress Back To The Top Button Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-10-02

   Medium·CVSS 4.8

   Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in YYDevelopment Back To The Top Button plugin <= 2.1.5 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.