Era404

7 CVEs across 4 Era404 products. Browse Era404 vulnerabilities, severities, and proof-of-concept exploits.

Era404 products with known CVEs

ProductCVEs
Stafflist5
Croprefine1
Imagemeta1
Linkedinclude1
Era404 CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-12185Medium4.42025-11-27The StaffList plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.6 due to insuffici…
CVE-2025-52734High7.12025-10-22Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ERA404 CropRefine croprefine allows Reflected XSS.This is…
CVE-2025-57918High7.12025-09-22Cross-Site Request Forgery (CSRF) vulnerability in ERA404 LinkedInclude linkedinclude allows Stored XSS.This issue affects LinkedInclude: from n/a through <= 3…
CVE-2025-32255Medium5.32025-04-04Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ERA404 StaffList stafflist allows Retrieve Embedded Sensitive Data…
CVE-2025-32232Medium4.32025-04-04Missing Authorization vulnerability in ERA404 StaffList stafflist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects St…
CVE-2025-23845High7.12025-02-17Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ERA404 ImageMeta imagemeta allows Reflected XSS.This issu…
CVE-2024-13749Medium6.12025-02-12The StaffList plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing or incorrect…
CVE-2022-1556Critical9.82022-05-30The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when searching for Staff in th…