Skip to content

Davidanderson vulnerabilities

Products

Newest

davidanderson redux framework Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Scheme Name CVE-2026-110534 6.4 MediumNovember 7, 2026
davidanderson redux framework Redux Framework <= 4.5.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download_options AJAX Action CVE-2026-110705 5.3 MediumNovember 7, 2026
david anderson redux framework WordPress Redux Framework plugin <= 4.5.16 - Cross Site Scripting (XSS) vulnerability CVE-2026-119472 6.5 MediumNovember 6, 2026
davidanderson redux framework Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile CVE-2026-120533 6.4 MediumNovember 5, 2026
davidanderson redux framework Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key CVE-2026-104812 6.4 MediumNovember 5, 2026
davidanderson redux framework Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript CVE-2026-103997 6.5 MediumOctober 31, 2026
davidanderson redux framework Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id CVE-2026-102918 6.4 MediumOctober 30, 2026
david anderson redux framework WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability CVE-2026-116404 6.5 MediumOctober 28, 2026
davidanderson european vat compliance assistant for woocommerce European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header CVE-2026-100316 7.2 HighOctober 17, 2026
davidanderson redux framework Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension CVE-2025-14123 6.8 MediumOctober 9, 2026
davidanderson redux framework Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field CVE-2026-90992 6.4 MediumOctober 1, 2026
davidanderson redux framework Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter CVE-2026-88999 4.3 MediumOctober 1, 2026
davidanderson updraftplus: wp backup & migration plugin UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice CVE-2026-82841 5.3 MediumSeptember 27, 2026
davidanderson redux framework Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input CVE-2026-5410 6.4 MediumSeptember 19, 2026
davidanderson redux framework Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input CVE-2026-5400 6.4 MediumSeptember 19, 2026
davidanderson redux framework Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value CVE-2026-5399 6.4 MediumSeptember 10, 2026
davidanderson updraftplus: wp backup & migration plugin UpdraftPlus < 1.26.7 - Backup Restoration via CSRF CVE-2026-76549 5.9 MediumAugust 27, 2026
davidanderson redux framework Redux Framework < 4.5.13 - Subscriber+ Privilege Escalation to Administrator CVE-2026-12525 8.8 HighJuly 16, 2026
davidanderson updraftplus: wp backup & migration plugin UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc CVE-2026-10795 Public exploit 8.1 HighJune 11, 2026
davidanderson all-in-one security (aios) – security and firewall All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path CVE-2026-8438 7.2 HighJune 6, 2026
davidanderson easy updates manager Easy Updates Manager <= 9.0.20 - Reflected Cross-Site Scripting via 'paged' Parameter CVE-2026-7660 6.1 MediumMay 28, 2026
davidanderson wp-optimize – cache, compress images, minify & clean database to boost page speed & performance WP-Optimize <= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta CVE-2026-7252 8.1 HighMay 7, 2026
100plugins open user map, 5starplugins dynamic copyright year, easy age verify +128 more +130 more Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVE-2024-13362 6.1 MediumMay 1, 2026
davidanderson wp-optimize – cache, compress images, minify & clean database to boost page speed & performance WP-Optimize <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation CVE-2026-2712 5.4 MediumApril 10, 2026
davidanderson redux framework Redux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter CVE-2025-9488 6.4 MediumDecember 13, 2025
davidanderson wpget api – connect to any external rest api WPGet API <= 2.2.10 - Authenticated (Administrator+) Server-Side Request Forgery CVE-2024-13857 5.5 MediumMarch 7, 2025
davidanderson updraftplus: wp backup & migration plugin UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scripting CVE-2025-0215 6.1 MediumJanuary 15, 2025
davidanderson updraftplus: wp backup & migration plugin UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection CVE-2024-10957 8.8 HighJanuary 4, 2025
5starplugins easy age verify, featured images in rss for mailchimp & more, marijuana age verify +619 more +621 more Freemius SDK <= 2.4.2 - Missing Authorization Checks CVE-2022-4974 6.3 MediumOctober 16, 2024
davidanderson redux framework, redux gutenberg template library \& redux framework +1 more Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting CVE-2024-6828 7.2 HighJuly 23, 2024
davidanderson internal link juicer: seo auto linker for wordpress, internal link juicer link juicer: seo auto linker for wordpress +1 more WordPress Internal Link Juicer: SEO Auto Linker for WordPress plugin <= 2.24.3 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-37941 4.3 MediumJuly 12, 2024
davidanderson testimonial slider Testimonial Slider <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-4193 6.4 MediumMay 9, 2024
davidanderson internal link juicer: seo auto linker for wordpress, internallinkjuicer internal link juicer +1 more Internal Link Juicer <= 2.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-0657 4.4 MediumFebruary 9, 2024
davidanderson all-in-one security (aios) – security and firewall, updraftplus all-in-one security +1 more All-In-One Security (AIOS) – Security and Firewall <= 5.2.5 - Reflected Cross-Site Scripting CVE-2024-1037 6.1 MediumFebruary 7, 2024
updraftplus, davidanderson updraftplus: wp backup & migration plugin +1 more UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update CVE-2023-5982 5.4 MediumNovember 7, 2023