Wpexperts
12 CVEs across 20 Wpexperts products. Browse Wpexperts vulnerabilities, severities, and proof-of-concept exploits.
Wpexperts products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48838 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions. |
CVE-2024-13844 | Medium | 4.9 | 2025-03-08 | The Post SMTP plugin for WordPress is vulnerable to generic SQL Injection via the ‘columns’ parameter in all versions up to, and including, 3.1.2 due to insuff… |
CVE-2024-13713 | Medium | 6.5 | 2025-02-21 | The WPExperts Square For GiveWP plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.3.1 due to… |
CVE-2025-0521 | High | 7.2 | 2025-02-18 | The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, and including, 3.0.2… |
CVE-2025-24680 | High | 7.1 | 2025-01-27 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows… |
CVE-2025-22800 | Medium | 4.3 | 2025-01-13 | Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2024-12475 | Medium | 6.4 | 2025-01-04 | The WP Multi Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1 due to insufficient in… |
CVE-2024-52436 | High | 7.6 | 2024-11-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal Post SMTP post-smtp allows Blind SQL Injection… |
CVE-2024-43214 | Medium | 5.3 | 2024-08-26 | Missing Authorization vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2. |
CVE-2024-4753 | Medium | 4.8 | 2024-07-12 | The WP Secure Maintenance WordPress plugin before 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2024-1639 | Medium | 6.5 | 2024-06-21 | The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey()… |
CVE-2023-52233 | High | 8.6 | 2024-06-11 | Missing Authorization vulnerability in Post SMTP Post SMTP Mailer/Email Log.This issue affects Post SMTP Mailer/Email Log: from n/a through 2.8.6. |
CVE-2024-5207 | High | 7.2 | 2024-05-30 | The POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for WordPress is vulnerable to time-based SQ… |
CVE-2024-31297 | High | 7.5 | 2024-04-10 | Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0. |
CVE-2024-30469 | Medium | 5.3 | 2024-03-29 | Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0. |
CVE-2024-29128 | High | 7.1 | 2024-03-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Post SMTP POST SMTP allows Reflected XSS.This issue affec… |
CVE-2024-27959 | High | 7.1 | 2024-03-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpexpertsio WC Shop Sync – Integrate Square and WooCommer… |
CVE-2024-0656 | Medium | 4.4 | 2024-02-29 | The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2023-3178 | Medium | 4.3 | 2024-01-16 | The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users w… |
CVE-2023-6620 | High | 7.2 | 2024-01-15 | The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several parameters before using them in SQL statements, leading to a S… |
CVE-2023-6875 | Critical | 9.8 | 2024-01-11 | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of… |
CVE-2023-6621 | Medium | 6.1 | 2024-01-03 | The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-… |
CVE-2023-7027 | High | 7.2 | 2024-01-03 | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scrip… |
CVE-2023-6629 | Medium | 6.1 | 2024-01-03 | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Sc… |
CVE-2023-50902 | Medium | 4.3 | 2023-12-29 | Cross-Site Request Forgery (CSRF) vulnerability in WPExpertsio New User Approve.This issue affects New User Approve: from n/a through 2.5.1. |
CVE-2023-49842 | Medium | 5.9 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpexpertsio Rocket Maintenance Mode & Coming Soon Page al… |
CVE-2023-47853 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred – Points, Rewards, Gamification, Ranks, Bad… |
CVE-2023-48742 | High | 7.6 | 2023-11-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LicenseManager License Manager for WooCommerce license-ma… |
CVE-2023-5958 | Medium | 6.1 | 2023-11-27 | The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attac… |
CVE-2022-47181 | Medium | 4.3 | 2023-11-07 | Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-templates allows Cro… |
CVE-2023-4798 | Medium | 5.4 | 2023-10-16 | The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-priv… |
CVE-2023-3604 | High | 7.5 | 2023-08-21 | The Change WP Admin Login WordPress plugin before 1.1.4 discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offer… |
CVE-2023-3179 | High | 8.8 | 2023-07-17 | The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users w… |
CVE-2023-35096 | Medium | 6.5 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in myCred plugin <= 2.5 versions. |
CVE-2023-35038 | Medium | 5.4 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in wpexperts.Io WP PDF Generator plugin <= 1.2.2 versions. |
CVE-2021-4422 | Medium | 4.3 | 2023-07-12 | The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due to missing or incor… |
CVE-2023-3082 | High | 7.2 | 2023-07-12 | The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 due to insufficient… |
CVE-2023-32580 | Medium | 5.9 | 2023-06-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPExperts Password Protected plugin <= 2.6.2 versions. |
CVE-2019-25150 | High | 8.8 | 2023-06-07 | The Email Templates plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.3. This makes it possible for attackers to present… |
CVE-2023-0152 | Medium | 5.4 | 2023-06-05 | The WP Multi Store Locator WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/pos… |
CVE-2022-3237 | Medium | 4.8 | 2022-10-31 | The WP Contact Slider WordPress plugin before 2.4.8 does not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Sit… |
CVE-2022-2352 | High | 7.2 | 2022-09-26 | The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users su… |
CVE-2022-2351 | Medium | 4.8 | 2022-09-16 | The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high… |
CVE-2022-1301 | Medium | 4.8 | 2022-07-04 | The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders, which could allow high privileged use… |
CVE-2022-1625 | Medium | 4.3 | 2022-06-27 | The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow at… |
CVE-2022-1589 | High | 7.5 | 2022-05-30 | The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, wh… |
CVE-2022-1092 | Medium | 4.3 | 2022-04-25 | The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticate… |
CVE-2022-0363 | Medium | 4.3 | 2022-04-25 | The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenti… |
CVE-2022-0287 | Medium | 4.3 | 2022-04-25 | The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated use… |
CVE-2021-24755 | High | 8.8 | 2021-11-29 | The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploit… |