Creativemindssolutions vulnerabilities
31 vulnerabilities
Known vulnerabilities in Creativemindssolutions products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 22 products.
Products
22- CM On Demand Search And Replace5 vulnerabilities
- CM Tooltip Glossary4 vulnerabilities
- CM Answers3 vulnerabilities
- CM Business Directory – Optimise And Showcase Local Business3 vulnerabilities
- CM Custom Reports – Flexible Reporting To Track What Matters Most2 vulnerabilities
- CM E Mail Blacklist – Simple Email Filtering For Safer Registration2 vulnerabilities
- CM Map Locations2 vulnerabilities
- CM Pop Up Banners2 vulnerabilities
- CM Ad Changer1 vulnerabilities
- CM Ad Changer – A Simple Tool To Control And Optimize Your Site'S Banners1 vulnerabilities
- CM Business Directory1 vulnerabilities
- CM Download Manager1 vulnerabilities
- CM FAQ – Simplify Support With An Intuitive FAQ Management Tool1 vulnerabilities
- CM Header And Footer1 vulnerabilities
- CM Header And Footer – Add Custom Scripts And Styles To Your Header And Footer With Ease1 vulnerabilities
- CM Map Locations – Visualize And Share Your Locations In A Few Clicks1 vulnerabilities
- CM Pop Up – Create Engaging Popups To Capture Attention And Boost Interaction1 vulnerabilities
- CM Popup Plugin For Wordpress1 vulnerabilities
- CM Registration – Tailored Tool For Seamless Login And Invitation Based Registrations1 vulnerabilities
- CM Registration And Invitation Codes1 vulnerabilities
- CM Search And Replace – Optimize Content Edits With A Powerful Search And Replace Tool1 vulnerabilities
- CM Video Lessons Manager – Simplify Video Lessons Management For Better Education1 vulnerabilities
MediumCVE-2025-54045creativemindssolutions · cm on demand search and replace +1 moreWordPress CM On Demand Search And Replace plugin <= 1.5.5 - Broken Access Control vulnerabilityMissing Authorization vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.5.EPSS0.22%MediumCVE-2025-54018creativemindssolutions · cm pop-up banners +1 moreWordPress CM Pop-Up banners plugin <= 1.8.4 - Broken Access Control VulnerabilityMissing Authorization vulnerability in CreativeMindsSolutions CM Pop-Up banners cm-pop-up-banners allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Pop-Up banners: from n/a through <= 1.8.4.EPSS0.25%MediumCVE-2025-54727creativemindssolutions · cm on demand search and replace +1 moreWordPress CM On Demand Search And Replace Plugin <= 1.5.2 - Cross Site Scripting (XSS) VulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Stored XSS.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.2.EPSS0.18%MediumCVE-2025-54728creativemindssolutions · cm on demand search and replace +1 moreWordPress CM On Demand Search And Replace Plugin <= 1.5.2 - Cross Site Request Forgery (CSRF) VulnerabilityCross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Cross Site Request Forgery.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.2.EPSS0.13%MediumCVE-2025-2166creativemindssolutions · cm faq – simplify support with an intuitive faq management tool +1 moreCM FAQ – Simplify support with an intuitive FAQ management tool <= 1.2.5 - Reflected Cross-Site ScriptingThe CM FAQ – Simplify support with an intuitive FAQ management tool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.EPSS0.33%MediumCVE-2025-11167creativemindssolutions · cm registration – tailored tool for seamless login and invitation-based registrations +1 moreCM Registration – Tailored tool for seamless login and invitation-based registrations <= 2.5.6 - Open RedirectThe CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.5.6. This is due to insufficient validation on the redirect url supplied via the 'redirect_url' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.EPSS0.21%HighCVE-2025-48151creativemindssolutions · cm map locations +1 moreWordPress CM Map Locations <= 2.1.6 - Cross Site Scripting (XSS) VulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations cm-map-locations allows Reflected XSS.This issue affects CM Map Locations: from n/a through <= 2.1.6.EPSS0.23%MediumCVE-2025-31091creativemindssolutions · cm header and footer +1 moreWordPress CM Header and Footer plugin <= 1.2.4 - Cross Site Scripting (XSS) VulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Header and Footer cm-header-footer-script-loader allows Stored XSS.This issue affects CM Header and Footer: from n/a through <= 1.2.4.EPSS0.27%HighCVE-2025-46245cminds · cm_ad_changer +2 moreWordPress CM Ad Changer plugin <= 2.0.5 - Cross Site Request Forgery (CSRF) VulnerabilityCross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Ad Changer cm-ad-changer allows Cross Site Request Forgery.This issue affects CM Ad Changer: from n/a through <= 2.0.5.EPSS0.17%HighCVE-2025-46246cminds · cm_answers +2 moreWordPress CM Answers plugin <= 3.3.3 - Cross Site Request Forgery (CSRF) VulnerabilityCross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Answers cm-answers allows Cross Site Request Forgery.This issue affects CM Answers: from n/a through <= 3.3.3.EPSS0.17%MediumCVE-2025-10178creativemindssolutions · cm business directory – optimise and showcase local business +1 moreCM Business Directory <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingThe CM Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cmbd_featured_image' shortcode in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.24%HighCVE-2025-24694creativemindssolutions · cm pop-up banners +1 moreWordPress CM Pop-Up Banners plugin <= 1.7.6 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Pop-Up banners cm-pop-up-banners allows Reflected XSS.This issue affects CM Pop-Up banners: from n/a through <= 1.7.6.EPSS0.39%HighCVE-2025-24758creativemindssolutions · cm map locations +1 moreWordPress CM Map Locations plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations cm-map-locations allows Reflected XSS.This issue affects CM Map Locations: from n/a through <= 2.0.8.EPSS0.39%MediumCVE-2025-32210creativemindssolutions · cm registration and invitation codes +1 moreWordPress CM Registration and Invitation Codes plugin <= 2.5.6 - Broken Access Control vulnerabilityMissing Authorization vulnerability in CreativeMindsSolutions CM Registration and Invitation Codes cm-invitation-codes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Registration and Invitation Codes: from n/a through <= 2.5.6.EPSS0.34%CriticalCVE-2025-30910creativemindssolutions · cm download manager +1 moreWordPress CM Download Manager plugin <= 2.9.6 - Arbitrary File Deletion vulnerabilityImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CreativeMindsSolutions CM Download Manager cm-download-manager allows Path Traversal.This issue affects CM Download Manager: from n/a through <= 2.9.6.EPSS0.61%MediumCVE-2024-54267creativemindssolutions · cm answers +1 moreWordPress CM Answers plugin <= 3.2.6 - Broken Access Control vulnerabilityMissing Authorization vulnerability in CreativeMindsSolutions CM Answers cm-answers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Answers: from n/a through <= 3.2.6.EPSS0.44%MediumCVE-2024-11202creativemindssolutions · cm business directory – optimise and showcase local business +13 moreMultiple Plugins <= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide ShortcodeMultiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.EPSS0.60%MediumCVE-2024-48041creativemindssolutions · cm tooltip glossary +1 moreWordPress CM Tooltip Glossary plugin <= 4.3.9 - Stored Cross-Site Scripting vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Tooltip Glossary enhanced-tooltipglossary allows Stored XSS.This issue affects CM Tooltip Glossary: from n/a through <= 4.3.9.EPSS0.29%MediumCVE-2024-4086creativemindssolutions · cm tooltip glossary +1 moreCM Tooltip Glossary – Powerful Glossary Plugin <= 4.2.11 - Cross-Site Request ForgeryThe CM Tooltip Glossary – Powerful Glossary Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.11. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the plugin's settings or reset them via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.EPSS0.25%MediumCVE-2024-43149creativemindssolutions · cm tooltip glossary +1 moreWordPress CM Tooltip Glossary Plugin <= 4.3.7 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Tooltip Glossary allows Stored XSS.This issue affects CM Tooltip Glossary: from n/a through 4.3.7.EPSS0.26%