Cminds
24 CVEs across 11 Cminds products. Browse Cminds vulnerabilities, severities, and proof-of-concept exploits.
Cminds products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5026 | Medium | 4.8 | 2025-05-15 | The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2025-46246 | Medium | 4.3 | 2025-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Answers cm-answers allows Cross Site Request Forgery.This issue affects CM Answers… |
CVE-2025-46245 | Medium | 4.3 | 2025-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Ad Changer cm-ad-changer allows Cross Site Request Forgery.This issue affects CM A… |
CVE-2024-5029 | Medium | 4.8 | 2024-11-21 | The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, w… |
CVE-2024-5030 | Low | 3.8 | 2024-11-18 | The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a lo… |
CVE-2024-5799 | Medium | 4.8 | 2024-09-12 | The CM Pop-Up Banners for WordPress plugin before 1.7.3 does not sanitise and escape some of its popup fields, which could allow high privilege users such as C… |
CVE-2024-5004 | Medium | 4.8 | 2024-07-22 | The CM Popup Plugin for WordPress WordPress plugin before 1.6.6 does not sanitise and escape some of the campaign settings, which could allow high privilege u… |
CVE-2024-5167 | High | 8.1 | 2024-07-13 | The CM Email Registration Blacklist and Whitelist WordPress plugin before 1.4.9 does not have CSRF check when adding or deleting an item from the blacklist or… |
CVE-2024-5028 | Medium | 6.5 | 2024-07-13 | The CM WordPress Search And Replace Plugin WordPress plugin before 1.3.9 does not have CSRF checks in some places, which could allow attackers to make logged i… |
CVE-2024-1962 | High | 8.8 | 2024-03-25 | The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit down… |
CVE-2024-1232 | Medium | 4.8 | 2024-03-25 | The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete do… |
CVE-2024-1231 | Medium | 6.8 | 2024-03-25 | The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish… |
CVE-2023-30750 | High | 8.5 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeMindsSolutions CM Popup Plugin for WordPress.This… |
CVE-2023-28749 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions. |
CVE-2023-31228 | Medium | 5.9 | 2023-08-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions. |
CVE-2023-25992 | Medium | 5.9 | 2023-03-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeMindsSolutions CM Answers plugin <= 3.1.9 versions. |
CVE-2022-3076 | High | 7.2 | 2022-09-26 | The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the… |
CVE-2021-24713 | Medium | 4.8 | 2021-11-23 | The Video Lessons Manager WordPress plugin before 1.7.2 and Video Lessons Manager Pro WordPress plugin before 3.5.9 do not properly sanitize and escape values… |
CVE-2021-24678 | Medium | 5.4 | 2021-10-04 | The CM Tooltip Glossary WordPress plugin before 3.9.21 does not escape some glossary_tooltip shortcode attributes, which could allow users a role as low as Con… |
CVE-2020-24146 | High | 8.1 | 2021-07-07 | Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possi… |
CVE-2020-24145 | Medium | 6.1 | 2021-07-07 | Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbi… |
CVE-2020-27344 | Medium | 6.1 | 2020-10-21 | The cm-download-manager plugin before 2.8.0 for WordPress allows XSS. |
CVE-2016-1000132 | Medium | 6.1 | 2016-10-10 | Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8 |
CVE-2014-9129 | | 2014-12-05 | Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack t… |