Wpexperts vulnerabilities
56 vulnerabilities
Known vulnerabilities in Wpexperts products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 22 products.
Products
22- Post Smtp21 vulnerabilities
- Mycred7 vulnerabilities
- Wp Multi Store Locator3 vulnerabilities
- All In One Login2 vulnerabilities
- License Manager For Woocommerce2 vulnerabilities
- New User Approve2 vulnerabilities
- Password Protected2 vulnerabilities
- Wholesale For Woocommerce2 vulnerabilities
- Wp Contact Slider2 vulnerabilities
- Advanced File Manager1 vulnerabilities
- Apiexperts Square For Woocommerce1 vulnerabilities
- CF7 Apps1 vulnerabilities
- Email Templates1 vulnerabilities
- Email Templates Customizer And Designer1 vulnerabilities
- Givewp Square1 vulnerabilities
- Gravity Forms Bookings Premium1 vulnerabilities
- Rocket Maintenance Mode \& Coming Soon Page1 vulnerabilities
- User Avatar Reloaded1 vulnerabilities
- Wc Shop Sync1 vulnerabilities
- WP Easypay1 vulnerabilities
- Wp Pdf Generator1 vulnerabilities
- Wp Secure Maintenance1 vulnerabilities
CVE-2026-110365wpexpertsadvanced file manager
EPSS score0.24%
Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14.CVE-2026-96449wpexpertswp easypayEPSS score0.19%
Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP EasyPay: from n/a through 4.5.4.CVE-2026-110367wpexpertsapiexperts square for woocommerceEPSS score0.21%
Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.CVE-2021-4422saadiqbalpost smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app+2EPSS score0.54%
The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due to missing or incorrect nonce validation on the handleCsvExport() function. This makes it possible for unauthenticated attackers to trigger a CSV export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.CVE-2021-24755unknownmycred – points, rewards, gamification, ranks, badges & loyalty plugin+2EPSS score1.36%
The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated userCVE-2025-0521saadiqbalpost smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app+2EPSS score0.33%
The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-22800saad iqbalpost smtp+2EPSS score0.40%
Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from n/a through <= 2.9.11.CVE-2025-24680wordpresswp-multi-store-locator+2EPSS score0.26%
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Reflected XSS.This issue affects WP Multistore Locator: from n/a through <= 2.4.7.CVE-2022-2351unknownpost smtp mailer/email log+2EPSS score0.68%
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed.CVE-2022-2352unknownpost smtp mailer/email log+2EPSS score1.38%
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example.CVE-2022-1092unknownmycred+2EPSS score0.43%
The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in the blogCVE-2022-1625unknownnew user approve+2EPSS score0.38%
The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow attackers to add invitation codes (for bypassing the provided restrictions) and to change plugin settings by tricking admin users into visiting specially crafted websites.CVE-2022-1589unknownchange wp-admin login+2EPSS score0.61%
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vectorCVE-2022-1301unknownwp contact slider+2EPSS score0.59%
The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders, which could allow high privileged users such as editor and above to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowedCVE-2022-47181wordpressemail-templates+2EPSS score0.28%
Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-templates allows Cross Site Request Forgery.This issue affects Email Templates Customizer and Designer for WordPress and WooCommerce: from n/a through 1.4.2.CVE-2022-0363unknownmycred+2EPSS score0.34%
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.CVE-2022-0287unknownmycred+2EPSS score0.78%
The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated user, such as subscriber to call and retrieve all email addresses from the blogCVE-2022-3237unknownwp contact slider+2EPSS score0.58%
The WP Contact Slider WordPress plugin before 2.4.8 does not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.CVE-2024-13844saadiqbalpost smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app+2EPSS score0.40%
The Post SMTP plugin for WordPress is vulnerable to generic SQL Injection via the ‘columns’ parameter in all versions up to, and including, 3.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.CVE-2024-13713saadiqbalwpexperts square for givewp+2EPSS score0.43%
The WPExperts Square For GiveWP plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.