Era404
7 CVEs across 4 Era404 products. Browse Era404 vulnerabilities, severities, and proof-of-concept exploits.
Era404 products with known CVEs
Era404 CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-12185 | Medium | 4.4 | 2025-11-27 | The StaffList plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.6 due to insuffici… |
CVE-2025-52734 | High | 7.1 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ERA404 CropRefine croprefine allows Reflected XSS.This is… |
CVE-2025-57918 | High | 7.1 | 2025-09-22 | Cross-Site Request Forgery (CSRF) vulnerability in ERA404 LinkedInclude linkedinclude allows Stored XSS.This issue affects LinkedInclude: from n/a through <= 3… |
CVE-2025-32255 | Medium | 5.3 | 2025-04-04 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ERA404 StaffList stafflist allows Retrieve Embedded Sensitive Data… |
CVE-2025-32232 | Medium | 4.3 | 2025-04-04 | Missing Authorization vulnerability in ERA404 StaffList stafflist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects St… |
CVE-2025-23845 | High | 7.1 | 2025-02-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ERA404 ImageMeta imagemeta allows Reflected XSS.This issu… |
CVE-2024-13749 | Medium | 6.1 | 2025-02-12 | The StaffList plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing or incorrect… |
CVE-2022-1556 | Critical | 9.8 | 2022-05-30 | The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when searching for Staff in th… |