A3rev
8 CVEs across 9 A3rev products. Browse A3rev vulnerabilities, severities, and proof-of-concept exploits.
A3rev products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6427 | Medium | 6.4 | 2026-05-28 | The a3 Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.7.6 This is due to a regex bug in th… |
CVE-2025-9873 | Medium | 6.4 | 2025-12-13 | The a3 Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.7.5 due to insufficient input saniti… |
CVE-2025-5123 | Medium | 6.4 | 2025-06-13 | The Contact Us Page – Contact People plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and inc… |
CVE-2025-2816 | High | 8.1 | 2025-05-01 | The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability ch… |
CVE-2024-12435 | Medium | 6.1 | 2025-01-07 | The Compare Products for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘s_feature’ parameter in all versions up to… |
CVE-2024-12313 | High | 8.1 | 2025-01-07 | The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization… |
CVE-2024-1807 | Medium | 6.5 | 2024-04-02 | The Product Sort and Display for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the p… |
CVE-2023-29097 | Medium | 5.9 | 2023-08-14 | Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in a3rev Software a3 Portfolio plugin <= 3.1.0 versions. |
CVE-2019-25144 | Medium | 5.4 | 2023-06-07 | The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.2.10 due to insufficient input sanitization. This mak… |
CVE-2023-23973 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Contact Us Page – Contact People plugin <= 3.7.0. |
CVE-2023-0095 | Medium | 5.4 | 2023-02-06 | The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the b… |
CVE-2022-40131 | Medium | 5.4 | 2022-11-03 | Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Page View Count plugin <= 2.5.5 on WordPress allows an attacker to reset the plugin settings. |
CVE-2022-0434 | Critical | 9.8 | 2022-03-07 | The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpoint… |
CVE-2021-24509 | Medium | 5.4 | 2021-08-09 | The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvc_stats shortcode, allowing users with a role as low as Contributor… |