Mainwp
24 CVEs across 26 Mainwp products. Browse Mainwp vulnerabilities, severities, and proof-of-concept exploits.
Mainwp products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57327 | Medium | 6.3 | 2026-06-29 | Subscriber Broken Access Control in MainWP <= 6.1.1 versions. |
CVE-2026-27366 | High | 7.5 | 2026-06-25 | Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions. |
CVE-2026-4299 | Medium | 5.3 | 2026-04-08 | The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This is due to a missing capabi… |
CVE-2024-10783 | High | 8.1 | 2024-12-13 | The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missi… |
CVE-2016-15041 | High | 7.2 | 2024-10-16 | The MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… |
CVE-2024-7492 | High | 8.8 | 2024-08-08 | The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or… |
CVE-2023-23640 | Medium | 5.4 | 2024-06-09 | Missing Authorization vulnerability in MainWP MainWP UpdraftPlus Extension.This issue affects MainWP UpdraftPlus Extension: from n/a through 4.0.6. |
CVE-2023-23639 | Medium | 5.4 | 2024-06-09 | Missing Authorization vulnerability in MainWP MainWP Staging Extension.This issue affects MainWP Staging Extension: from n/a through 4.0.3. |
CVE-2023-23645 | Critical | 9.9 | 2024-05-17 | Improper Control of Generation of Code ('Code Injection') vulnerability in MainWP MainWP Code Snippets Extension allows Code Injection.This issue affects MainW… |
CVE-2024-33680 | Medium | 5.4 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in MainWP MainWP Child Reports.This issue affects MainWP Child Reports: from n/a through 2.1.1. |
CVE-2023-23649 | High | 8.1 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in MainWP MainWP Links Manager Extension.This issue affects MainWP Links Manager Extension: from n/a through 2… |
CVE-2023-23656 | Critical | 10.0 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in MainWP MainWP File Uploader Extension.This issue affects MainWP File Uploader Extension: from… |
CVE-2023-22699 | Medium | 5.4 | 2024-03-25 | Missing Authorization vulnerability in MainWP MainWP Wordfence Extension.This issue affects MainWP Wordfence Extension: from n/a through 4.0.7. |
CVE-2024-1642 | Medium | 4.3 | 2024-03-13 | The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up… |
CVE-2023-38519 | High | 7.6 | 2023-12-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MainWP MainWP Dashboard – WordPress Manager for Multiple… |
CVE-2023-6164 | Low | 2.2 | 2023-11-22 | The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in… |
CVE-2023-23737 | Critical | 9.3 | 2023-10-12 | Unauth. SQL Injection (SQLi) vulnerability in MainWP MainWP Broken Links Checker Extension plugin <= 4.0 versions. |
CVE-2023-23651 | High | 8.5 | 2023-10-12 | Auth. (subscriber+) SQL Injection (SQLi) vulnerability in MainWP Google Analytics Extension plugin <= 4.0.4 versions. |
CVE-2023-23660 | High | 8.5 | 2023-07-18 | Auth. (subscriber+) SQL Injection (SQLi) vulnerability in MainWP MainWP Maintenance Extension plugin <= 4.1.1 versions. |
CVE-2023-3132 | Medium | 5.9 | 2023-06-27 | The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufficient controls on… |
CVE-2023-23650 | Medium | 6.5 | 2023-03-23 | Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in MainWP MainWP Code Snippets Extension plugin <= 4.0.2 versions. |
CVE-2023-23659 | Medium | 4.3 | 2023-02-23 | Cross-Site Request Forgery (CSRF) vulnerability in MainWP Matomo Extension <= 4.0.4 versions. |
CVE-2021-24877 | High | 7.2 | 2021-11-23 | The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL inject… |
CVE-2021-24754 | High | 7.2 | 2021-10-18 | The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashbo… |