10up
11 CVEs across 10 10up products. Browse 10up vulnerabilities, severities, and proof-of-concept exploits.
10up products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-5028 | Medium | 6.5 | 2026-05-12 | The Eight Day Week Print Workflow plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'title' parameter in the `pp-get-articles` AJAX… |
CVE-2026-25311 | Medium | 5.4 | 2026-02-19 | Missing Authorization vulnerability in 10up Autoshare for Twitter autoshare-for-twitter allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-67621 | Medium | 4.3 | 2025-12-24 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in 10up Eight Day Week Print Workflow eight-day-week-print-workflow al… |
CVE-2025-10749 | Medium | 5.4 | 2025-10-24 | The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5… |
CVE-2025-8482 | Medium | 4.3 | 2025-08-12 | The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of data in version 2.8.4. This is due to a missing capability check on… |
CVE-2023-32798 | Medium | 5.3 | 2024-12-13 | Missing Authorization vulnerability in 10up Simple Page Ordering allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sim… |
CVE-2024-10786 | Medium | 4.3 | 2024-11-16 | The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the sla_clear_user_cache f… |
CVE-2024-8378 | Medium | 4.8 | 2024-11-07 | The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for example for code that us… |
CVE-2024-43116 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.10. |
CVE-2024-35684 | Medium | 4.3 | 2024-06-08 | Cross-Site Request Forgery (CSRF) vulnerability in 10up ElasticPress elasticpress.This issue affects ElasticPress: from n/a through <= 5.1.1. |
CVE-2023-48753 | Medium | 5.3 | 2024-06-04 | Authentication Bypass by Spoofing vulnerability in 10up Restricted Site Access allows Accessing Functionality Not Properly Constrained by ACLs.This issue affec… |
CVE-2021-4405 | Medium | 4.3 | 2023-07-01 | The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to missing or incorrect… |
CVE-2022-1613 | Medium | 5.3 | 2022-09-26 | The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it po… |
CVE-2022-1091 | Medium | 6.1 | 2022-04-18 | The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploit… |
CVE-2019-18855 | High | 7.5 | 2019-11-11 | A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attribu… |
CVE-2019-18854 | High | 7.5 | 2019-11-11 | A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ... xlin… |