Unknown Wpcode vulnerabilities
4 vulnerabilities
Known vulnerabilities in Unknown Wpcode, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2026-101301unknown · wpcodeWPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode BypassThe WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests.EPSS0.26%MediumCVE-2023-1624unknown · wpcode +2 moreWPCode Lite < 2.0.9 - Arbitrary Log File Deletion via CSRFThe WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcode_activate_snippets capability delete arbitrary log files on the server, including outside of the blog foldersEPSS0.31%MediumCVE-2023-0328unknown · wpcode +2 moreWPCode < 2.0.7 - Contributor+ WPCode Library Auth Key Update/DeletionThe WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can edit posts to call the endpoints related to WPCode Library authentication (such as update and delete the auth key).EPSS0.80%MediumCVE-2023-3524unknown · wpcode +2 moreWPCode < 2.0.13.1 - Reflected XSSThe WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site ScriptingEPSS0.52%