10up vulnerabilities

Products

• Elasticpress 4
• Safe Svg 4
• Distributor 3
• Simple Local Avatars 3
• Eight Day Week Print Workflow 2
• Restricted Site Access 2
• Safe Svg 2

Newest

• 10up distributor Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions CVE-2026-111631 5.3 MediumOctober 16, 2026
• 10up distributor 10up Distributor before 2.3.2 PHP Object Injection via set_meta() CVE-2026-111628 2.3 LowOctober 16, 2026
• 10up distributor 10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action CVE-2026-111625 5.3 MediumOctober 16, 2026
• 10up restricted site access WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability CVE-2026-110227 5.3 MediumOctober 14, 2026
• 10up safe svg WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-94672 4.3 MediumSeptember 30, 2026
• 10up safe svg WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-94077 6.5 MediumSeptember 30, 2026
• 10up elasticpress WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability CVE-2026-62088 5.3 MediumSeptember 11, 2026
• 10up eight day week print workflow Eight Day Week Print Workflow <= 1.2.6 - Authenticated (Subscriber+) SQL Injection via 'title' Parameter CVE-2026-5028 6.5 MediumMay 12, 2026
• 10up autoshare for twitter WordPress Autoshare for Twitter plugin <= 2.3.1 - Broken Access Control vulnerability CVE-2026-25311 5.4 MediumFebruary 19, 2026
• 10up eight day week print workflow WordPress Eight Day Week Print Workflow plugin <= 1.2.5 - Sensitive Data Exposure vulnerability CVE-2025-67621 4.3 MediumDecember 24, 2025
• 10up microsoft azure storage for wordpress Microsoft Azure Storage for WordPress <= 4.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion CVE-2025-10749 5.4 MediumOctober 24, 2025
• 10up simple local avatars Simple Local Avatars <= 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Avatar Migration CVE-2025-8482 4.3 MediumAugust 12, 2025
• 10up simple page ordering WordPress Simple Page Ordering plugin <= 2.5.0 - Broken Access Control vulnerability CVE-2023-32798 5.3 MediumDecember 13, 2024
• 10up simple local avatars Simple Local Avatars <= 2.7.11 - Missing Authorization to Authenticated (Subscriber+) User Cache Clearing CVE-2024-10786 4.3 MediumNovember 16, 2024
• 10up safe svg Safe SVG < 2.2.6 - Author+ SVG Sanitisation Bypass CVE-2024-8378 4.8 MediumNovember 7, 2024
• 10up simple local avatars WordPress Simple Local Avatars plugin <= 2.7.10 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-43116 4.3 MediumAugust 26, 2024
• 10up elasticpress WordPress ElasticPress plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-35684 4.3 MediumJune 8, 2024
• 10up restricted site access, elasticpress +1 more WordPress Restricted Site Access plugin <= 7.4.1 - IP Restriction Bypass vulnerability CVE-2023-48753 5.3 MediumJune 4, 2024
• 10up elasticpress ElasticPress <= 3.5.3 - Cross-Site Request Forgery Bypass CVE-2021-4405 4.3 MediumJuly 1, 2023
• 10up restricted site access Restricted Site Access < 7.3.2 - Access Bypass via IP Spoofing CVE-2022-1613 5.3 MediumSeptember 26, 2022
• 10up safe svg Safe SVG < 1.9.10 - SVG Sanitisation Bypass CVE-2022-1091 Fix available 6.1 MediumApril 18, 2022
• 10up safe svg A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for... CVE-2019-18854 7.5 HighNovember 11, 2019
• 10up safe svg A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for... CVE-2019-18855 7.5 HighNovember 11, 2019