CVE-2025-11877 | High | 7.5 | 2026-01-07 | The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_fail… |
CVE-2025-62122 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in solwininfotech Trash Duplicate and 301 Redirect trash-duplicate-and-301-redirect allows Exploiting Incorrectly Configure… |
CVE-2025-57990 | Medium | 5.4 | 2025-09-22 | Missing Authorization vulnerability in solwininfotech Blog Designer blog-designer allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-32677 | High | 7.6 | 2025-04-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in solwininfotech WP Social Stream Designer social-stream-de… |
CVE-2024-13468 | High | 7.5 | 2025-02-19 | The Trash Duplicate and 301 Redirect plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'duplicates-actio… |
CVE-2024-11437 | Medium | 4.9 | 2025-01-07 | The Timeline Designer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.4 due to insufficient e… |
CVE-2022-45078 | Medium | 5.9 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Solwin Infotech User Blocker.This issue affects User Blocker: from n/a through 1.5.5. |
CVE-2023-37966 | High | 7.6 | 2023-10-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log user-activity-log allow… |
CVE-2023-5167 | Medium | 5.4 | 2023-10-16 | The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activity logs dashboard, which may allow visi… |
CVE-2023-5133 | High | 7.5 | 2023-10-16 | This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate i… |
CVE-2023-4279 | High | 7.5 | 2023-09-04 | This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its v… |
CVE-2023-4269 | Medium | 4.3 | 2023-09-04 | The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subs… |
CVE-2023-30485 | High | 7.1 | 2023-09-04 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Solwin Infotech Responsive WordPress Slider – Avartan Slider Lite plugin <= 1.5.3 versions. |
CVE-2023-3435 | Critical | 9.8 | 2023-08-14 | The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its… |
CVE-2023-2761 | High | 7.2 | 2023-07-24 | The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some… |
CVE-2022-4793 | Medium | 5.4 | 2023-01-30 | The Blog Designer WordPress plugin before 2.4.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as con… |