Joomunited
22 CVEs across 13 Joomunited products. Browse Joomunited vulnerabilities, severities, and proof-of-concept exploits.
Joomunited products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9643 | High | 7.2 | 2026-06-24 | The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REQUEST_URI server variable in all versions up to, an… |
CVE-2026-9620 | Medium | 6.4 | 2026-06-24 | The WP Latest Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted image src attributes in post content in versions up to, and i… |
CVE-2026-11370 | Medium | 6.4 | 2026-06-24 | The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.5.18 via the 'new_link' parameter. Th… |
CVE-2026-9690 | High | 7.5 | 2026-06-17 | Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions. |
CVE-2025-5034 | High | 7.1 | 2025-06-21 | The wp-file-download WordPress plugin before 6.2.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2024-13374 | Medium | 4.3 | 2025-02-12 | The WP Table Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on thewptm_getFolders AJAX action in all versi… |
CVE-2022-47601 | Medium | 5.3 | 2025-01-02 | Missing Authorization vulnerability in JoomUnited WP Table Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects W… |
CVE-2024-45456 | Medium | 6.5 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This… |
CVE-2024-45455 | Medium | 5.9 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This… |
CVE-2024-4135 | Medium | 5.4 | 2024-05-08 | The WP Latest Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the plugin… |
CVE-2023-6962 | Medium | 5.3 | 2024-05-02 | The WP Meta SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.12 via the meta description. Thi… |
CVE-2023-6961 | High | 7.2 | 2024-05-02 | The WP Meta SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Referer’ header in all versions up to, and including, 4.5.12 due to… |
CVE-2024-32539 | Medium | 6.5 | 2024-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP File Download Light allows Stored XSS.This… |
CVE-2024-25908 | Medium | 4.3 | 2024-04-11 | Missing Authorization vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2. |
CVE-2024-25907 | Medium | 5.4 | 2024-04-11 | Missing Authorization vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2. |
CVE-2024-25909 | Critical | 9.9 | 2024-02-26 | Unrestricted Upload of File with Dangerous Type vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2. |
CVE-2024-22148 | High | 7.1 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Editor JoomUnited allows Reflected XSS.This issu… |
CVE-2023-1381 | High | 8.8 | 2023-04-10 | The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserializa… |
CVE-2022-47602 | Medium | 6.5 | 2023-03-29 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in JoomUnited WP Table Manager plugin <= 3.5.2 versions. |
CVE-2023-0876 | Medium | 6.1 | 2023-03-20 | The WP Meta SEO WordPress plugin before 4.5.3 does not authorize several ajax actions, allowing low-privilege users to make updates to certain data and leading… |
CVE-2023-0875 | High | 8.8 | 2023-03-20 | The WP Meta SEO WordPress plugin before 4.5.3 does not properly sanitize and escape inputs into SQL queries, leading to a blind SQL Injection vulnerability tha… |
CVE-2023-1028 | Medium | 4.3 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to missing or incorrect n… |
CVE-2023-1027 | Medium | 4.3 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the checkAllCategoryInSitemap functi… |
CVE-2023-1026 | Medium | 4.3 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the listPostsCategory function in versio… |
CVE-2023-1024 | Medium | 4.3 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the regenerateSitemaps function in v… |
CVE-2023-1023 | Medium | 5.4 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the saveSitemapSettings function… |
CVE-2023-1022 | Medium | 5.4 | 2023-02-28 | The WP Meta SEO plugin for WordPress is vulnerable to unauthorized options update due to a missing capability check on the wpmsGGSaveInformation function in ve… |
CVE-2023-1029 | Medium | 4.3 | 2023-02-24 | The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to missing or incorrect n… |
CVE-2022-30337 | Medium | 5.4 | 2022-07-21 | Cross-Site Request Forgery (CSRF) vulnerability in JoomUnited WP Meta SEO plugin <= 4.4.8 at WordPress allows an attacker to update the social settings. |
CVE-2022-1093 | Medium | 4.8 | 2022-05-23 | The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege… |
CVE-2016-10913 | Medium | 6.1 | 2019-08-20 | The wp-latest-posts plugin before 3.7.5 for WordPress has XSS. |