CveMateVulnerability intelligence

Stiofan vulnerabilities

12 vulnerabilities

Known vulnerabilities in Stiofan products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 5 products.

Products

5

Userswp5 vulnerabilities
Blockstrap Page Builder Bootstrap Blocks2 vulnerabilities
Events Calendar For Geodirectory2 vulnerabilities
Getpaid2 vulnerabilities
Ayecode Connect1 vulnerabilities

CVE-2025-26967stiofanevents calendar for geodirectory+21y ago03-03-2025 13:30

Deserialization of Untrusted Data vulnerability in Stiofan Events Calendar for GeoDirectory events-for-geodirectory allows Object Injection.This issue affects Events Calendar for GeoDirectory: from n/a through <= 2.3.14.CVE-2025-66072stiofanuserswp+111mo ago21-11-2025 12:29

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through <= 1.2.47.CVE-2025-67593stiofanuserswp+110mo ago09-12-2025 14:14

Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.48.CVE-2025-30951stiofanblockstrap page builder - bootstrap blocks+11y ago06-06-2025 12:54

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Stored XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a through <= 0.1.36.CVE-2024-43973ayecodegetpaid+21y ago01-11-2024 14:17

Missing Authorization vulnerability in Stiofan GetPaid invoicing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetPaid: from n/a through <= 2.8.11.CVE-2024-56255stiofanayecode connect+11y ago02-01-2025 12:01

Missing Authorization vulnerability in Stiofan AyeCode Connect ayecode-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AyeCode Connect: from n/a through <= 1.3.8.CVE-2026-39532stiofanevents calendar for geodirectory+14mo ago15-06-2026 20:18

Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.CVE-2026-25015stiofanuserswp+18mo ago03-02-2026 14:08

Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.53.CVE-2026-103086stiofanuserswp+115d ago05-10-2026 18:08

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74.CVE-2026-94632stiofanblockstrap page builder - bootstrap blocks+112d ago09-10-2026 10:00

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Reflected XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a through 0.1.58.CVE-2026-94641stiofanuserswp+112d ago09-10-2026 10:00

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflected XSS.This issue affects UsersWP: from n/a through 1.2.73.CVE-2026-49064stiofangetpaid+14mo ago15-06-2026 13:01

Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve Embedded Sensitive Data. This issue affects GetPaid: from n/a through 2.8.49.