Specialk vulnerabilities

Products

• User Submitted Posts – Enable Users To Submit Posts From The Front End 9
• Simple Download Counter 5
• Dashboard Widgets Suite 3
• Prismatic 3
• Simple Ajax Chat – Add A Fast, Secure Chat Box 3
• Blackhole For Bad Bots 2

Newest

• specialk user submitted posts – enable users to submit posts from the front end User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting CVE-2026-119162 7.2 HighOctober 31, 2026
• specialk simple ajax chat – add a fast, secure chat box Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting CVE-2026-81825 7.2 HighSeptember 11, 2026
• specialk prismatic Prismatic <= 3.7.3 - Unauthenticated Stored Cross-Site Scripting via 'prismatic_encoded' Pseudo-Shortcode CVE-2026-3876 7.2 HighApril 16, 2026
• specialk simple download counter Simple Download Counter <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute CVE-2026-4278 6.4 MediumMarch 26, 2026
• specialk blackhole for bad bots Blackhole for Bad Bots <= 3.8 - Unauthenticated Stored Cross-Site Scripting via User-Agent HTTP Header CVE-2026-4329 7.2 HighMarch 26, 2026
• specialk simple ajax chat – add a fast, secure chat box Simple Ajax Chat <= 20260217 - Unauthenticated Stored Cross-Site Scripting via 'c' CVE-2026-2987 6.1 MediumMarch 12, 2026
• specialk user submitted posts – enable users to submit posts from the front end User Submitted Posts <= 20260113 - Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter CVE-2026-2126 5.3 MediumFebruary 18, 2026
• specialk user submitted posts – enable users to submit posts from the front end User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field CVE-2026-0800 7.2 HighJanuary 24, 2026
• jeff starr head meta data Head Meta Data <= 20251118 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta CVE-2026-0608 6.4 MediumJanuary 20, 2026
• specialk user submitted posts – enable users to submit posts from the front end User Submitted Posts <= 20260110 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcode CVE-2026-0913 6.4 MediumJanuary 16, 2026
• specialk simple download counter Simple Download Counter <= 2.2.2 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal CVE-2025-13677 4.9 MediumDecember 10, 2025
• specialk banhammer – monitor site traffic, block bad users and bots Banhammer – Monitor Site Traffic, Block Bad Users and Bots <= 3.4.8 - Unauthenticated Protection Mechanism Bypass CVE-2025-10745 5.3 MediumSeptember 26, 2025
• jeff starr simple download counter WordPress Simple Download Counter plugin <= 2.2 - Cross Site Scripting (XSS) Vulnerability CVE-2025-46240 6.5 MediumApril 22, 2025
• specialk user submitted posts – enable users to submit posts from the front end User Submitted Posts <= 20241026 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2025-2874 4.4 MediumApril 3, 2025
• specialk simple download counter Simple Download Counter <= 2.0 - Authenticated (Author+) Arbitrary File Read CVE-2025-1730 6.5 MediumMarch 1, 2025
• plugin-planet dashboard widgets suite Dashboard Widgets Suite <= 3.4.3 - Reflected Cross-Site Scripting CVE-2024-0979 6.1 MediumJune 13, 2024
• specialk simple ajax chat – add a fast, secure chat box Simple Ajax Chat <= 20231101 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-2956 4.4 MediumMarch 27, 2024
• jeff starr user submitted posts – enable users to submit posts from the front end, plugin-planet user submitted posts +1 more WordPress User Submitted Posts Plugin <= 20230902 is vulnerable to Arbitrary File Upload CVE-2023-45603 9.0 CriticalDecember 20, 2023
• jeff starr dashboard widgets suite, plugin-planet dashboard widget suite +1 more WordPress Dashboard Widgets Suite Plugin <= 3.4.1 is vulnerable to Cross Site Scripting (XSS) CVE-2023-49743 5.9 MediumDecember 14, 2023
• plugin-planet theme switcha, specialk theme switcha – easily switch themes for development and testing +1 more Theme Switcha <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-5614 6.4 MediumOctober 20, 2023
• plugin-planet simple download counter The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via... CVE-2023-4838 6.4 MediumSeptember 9, 2023
• plugin-planet user submitted posts, specialk user submitted posts – enable users to submit posts from the front end +1 more User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20230811 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-4779 6.4 MediumSeptember 6, 2023
• plugin-planet user submitted posts, specialk user submitted posts – enable users to submit posts from the front end +1 more User Submitted Posts <= 20230809 - Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content' CVE-2023-4308 7.2 HighAugust 15, 2023
• plugin-planet user submitted posts, specialk user submitted posts – enable users to submit posts from the front end +1 more User Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Upload CVE-2019-25138 9.8 CriticalJune 7, 2023
• jeff starr dashboard widgets suite, plugin-planet dashboard widget suite +1 more WordPress Dashboard Widgets Suite Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS) CVE-2023-26517 5.9 MediumMay 6, 2023
• plugin-planet blackhole for bad bots Blackhole for Bad Bots < 3.3.2 - Arbitrary IP Address Blocking via IP Spoofing CVE-2022-1165 9.1 CriticalApril 4, 2022
• jeff starr prismatic Prismatic < 2.8 - Reflected Cross-Site Scripting (XSS) CVE-2021-24409 6.1 MediumJuly 12, 2021
• jeff starr prismatic Prismatic < 2.8 - Contributor+ Stored XSS CVE-2021-24408 5.4 MediumJuly 12, 2021