Ayecode Ltd vulnerabilities
8 vulnerabilities
Known vulnerabilities in Ayecode Ltd products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 5 products.
Products
5- Userswp3 vulnerabilities
- Location Manager2 vulnerabilities
- API KEY For Google Maps1 vulnerabilities
- Geodirectory1 vulnerabilities
- Wordpress Payments Plugin | Getpaid1 vulnerabilities
CVE-2021-24361ayecode ltdlocation manager+2
EPSS score1.83%
In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameters, which are then used in a SQL statement, leading to unauthenticated SQL Injection issues.CVE-2021-24369ayecode ltdwordpress payments plugin | getpaid+2EPSS score0.62%
In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fields were not getting sanitized properly. So it was possible to inject malicious content such as img tags, leading to a Stored Cross-Site Scripting issue which is triggered when the form will be edited, for example when an admin reviews it and could lead to privilege escalation.CVE-2022-47442ayecode ltduserswp+2EPSS score0.68%
Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through 1.2.3.9.CVE-2022-29453ayecode ltdapi key for google maps+2EPSS score0.44%
Cross-Site Request Forgery (CSRF) vulnerability in API KEY for Google Maps plugin <= 1.2.1 at WordPress leading to Google Maps API key update.CVE-2024-31936ayecode ltduserswp+1EPSS score0.20%
Cross-Site Request Forgery (CSRF) vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a before 1.2.6.CVE-2024-43145ayecode ltdgeodirectory+2EPSS score0.44%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode Ltd GeoDirectory.This issue affects GeoDirectory: from n/a through 2.3.61.CVE-2024-43277ayecode ltduserswp+1EPSS score0.40%
Missing Authorization vulnerability in AyeCode Ltd UsersWP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.15.CVE-2026-85705ayecode ltdlocation manager+1EPSS score0.46%
The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is triggered when the orderby=lat_lon parameter is supplied, and affects multiple publicly accessible REST endpoints including geodir/v2/locations/cities, /regions, /countries, and /neighbourhoods via both the get_locations() and get_neighbourhoods() functions.