Inisev vulnerabilities

27 vulnerabilities

Known vulnerabilities in Inisev products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 13 products.

Products

13
5.3MediumCVE-2025-14944inisev · backupbliss – backup & migration with free cloud storage +1 moreBackup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline StorageThe Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded tokens which are publicly exposed in the plugin's JavaScript. This makes it possible for unauthenticated attackers to trigger the backup upload queue processing, potentially causing unexpected backup transfers to configured cloud storage targets and resource exhaustion.EPSS0.56%5.9MediumCVE-2024-2118inisev · social_media_share_buttons_\&_social_sharing_icons +2 moreSocial Media Share Buttons < 2.8.9 - Admin+ Stored XSS via settingsThe Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)EPSS0.40%6.5MediumCVE-2024-0559inisev · enhanced_text_widget +2 moreEnhanced Text Widget < 1.6.6 - Admin+ Stored XSSThe Enhanced Text Widget WordPress plugin before 1.6.6 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)EPSS0.50%5.4MediumCVE-2024-0561inisev · ultimate_posts_widget +2 moreUltimate Posts Widget < 2.3.1 - Admin+ Stored XSSThe Ultimate Posts Widget WordPress plugin before 2.3.1 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)EPSS0.44%4.3MediumCVE-2024-31435inisev · social media & share icons +11 moreWordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.6 - Broken Access Control vulnerability: Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Social Media & Share Icons: from n/a through 2.8.6.EPSS0.21%5.9MediumCVE-2024-37552inisev · social media & share icons +2 moreWordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Inisev Social Media & Share Icons allows Stored XSS.This issue affects Social Media & Share Icons: from n/a through 2.9.1.EPSS0.31%8.8HighCVE-2024-10932inisev · backupbliss – backup & migration with free cloud storage +1 moreBackup Migration <= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace'The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site in order to trigger the exploit.EPSS0.80%4.8MediumCVE-2024-10362inisev · social_media_share_buttons_\&_social_sharing_icons +2 moreSocial Media Share Buttons < 2.9.0 - Admin+ Stored XSSThe Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)EPSS0.36%5.3MediumCVE-2024-32686inisev · backup migration +1 moreWordPress Backup Migration plugin <= 1.4.3 - Sensitive Data Exposure via Log vulnerabilityInsertion of Sensitive Information into Log File vulnerability in Inisev Backup Migration.This issue affects Backup Migration: from n/a through 1.4.3.EPSS0.44%7.2HighCVE-2026-42697inisev · social share icons & social share buttons +1 moreWordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5.EPSS0.18%7.5HighCVE-2026-39480inisev · backup migration +1 moreWordPress Backup Migration plugin <= 2.1.1 - Sensitive Data Exposure vulnerabilityUnauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.EPSS0.42%7.2HighCVE-2026-7693inisev · backup migration +1 moreBackup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' ParameterThe Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the `file` POST parameter on the `restoreBackup()` AJAX handler. The handler applies `esc_attr()` — an HTML-context sanitizer that does not strip shell metacharacters — and concatenates the result, unquoted, into a `php-cli -f … bmi_restore <file> <remote>` command passed to `exec()`. This makes it possible for authenticated attackers, with Administrator-level access (or any user granted the plugin's `do_backups` capability) and above, to execute arbitrary OS commands as the web-server user, bypassing WordPress hardening constants such as `DISALLOW_FILE_EDIT` and `DISALLOW_FILE_MODS` that would otherwise prevent code execution from the admin UI. This is an incomplete fix of CVE-2023-7002, which patched the same pattern only in the `$_POST['url']` path of `handleQuickMigration()`; the equivalent mitigations (`rawurlencode()` + explicit shell-metachar replacement + double-quoting in `exec()`) were never applied to `$backupName`.EPSS2.95%8.1HighCVE-2026-53738inisev · copy & delete postsCopy & Delete Posts through 1.5.4 Privilege Escalation via cdp_action_handling HandlerCopy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler. Attackers with an enabled role can delete posts or overwrite plugin settings via the f parameter, bypassing per-function capability checks.EPSS0.44%7.2HighCVE-2026-66623inisev · social media & share icons +1 moreWordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerabilityUnauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.EPSS0.25%6.1MediumCVE-2026-89047inisev · social_media_share_buttons_\&_social_sharing_icons +1 moreSocial Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URLThe Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the victim to be on a mobile user-agent and to click the WeChat share icon, though once the dialog opens, script execution is automatic and requires no further user interaction.EPSS0.29%6.4MediumCVE-2026-89424inisev · duplicate post +1 moreDuplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' ParameterThe Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that the site owner has enabled the plugin's User Level Permissions for the Subscriber role, as this grants access to the i_saw_this_noti AJAX branch needed to deliver the payload.EPSS0.24%6.5MediumCVE-2023-1330inisev · redirection +2 moreRedirection < 1.1.4 - Redirect Creation via CSRFThe Redirection WordPress plugin before 1.1.4 does not add nonce verification in place when adding the redirect, which could allow attackers to add redirects via a CSRF attack.EPSS0.34%6.5MediumCVE-2023-1331inisev · redirection +2 moreRedirection < 1.1.5 - Plugin Reset via CSRFThe Redirection WordPress plugin before 1.1.5 does not have CSRF checks in the uninstall action, which could allow attackers to make logged in admins delete all the redirections through a CSRF attack.EPSS0.33%6.5MediumCVE-2023-0958backupbliss · backup_migration +31 moreInisev Plugins (Various Versions) - Missing Authorization on handle_installation functionSeveral plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.EPSS0.69%7.2HighCVE-2023-7002backupbliss · backup_migration +2 moreBackup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via urlThe Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operating system.EPSS30.79%