Stiofan vulnerabilities

Products

• Userswp 11
• Events Calendar For Geodirectory 3
• Getpaid 3
• Blockstrap Page Builder - Bootstrap Blocks 2

Newest

• ayecode ltd getpaid WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability CVE-2026-115609 7.1 HighOctober 28, 2026
• stiofan userswp WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability CVE-2026-94641 Public exploit 7.1 HighOctober 9, 2026
• stiofan blockstrap page builder - bootstrap blocks WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability CVE-2026-94632 7.1 HighOctober 9, 2026
• stiofan userswp WordPress UsersWP plugin <= 1.2.74 - Broken Access Control vulnerability CVE-2026-103086 6.5 MediumOctober 5, 2026
• stiofan userswp UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email CVE-2026-86814 8.1 HighSeptember 19, 2026
• stiofan userswp UsersWP < 1.2.67 - Two-Factor Authentication Bypass CVE-2026-13690 7.4 HighJuly 29, 2026
• stiofan events calendar for geodirectory WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability CVE-2026-39532 8.8 HighJune 15, 2026
• ayecode ltd getpaid WordPress GetPaid plugin <= 2.8.49 - Sensitive Data Exposure vulnerability CVE-2026-49064 7.5 HighJune 15, 2026
• stiofan events calendar for geodirectory Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation CVE-2026-11616 8.8 HighJune 9, 2026
• stiofan userswp WordPress UsersWP plugin <= 1.2.53 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-25015 4.3 MediumFebruary 3, 2026
• stiofan userswp WordPress UsersWP plugin <= 1.2.48 - Cross Site Request Forgery (CSRF) vulnerability CVE-2025-67593 4.3 MediumDecember 9, 2025
• stiofan userswp WordPress UsersWP plugin <= 1.2.47 - Broken Access Control vulnerability CVE-2025-66072 5.3 MediumNovember 21, 2025
• stiofan blockstrap page builder - bootstrap blocks WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.36 - Cross Site Scripting (XSS) Vulnerability CVE-2025-30951 6.5 MediumJune 6, 2025
• stiofan events calendar for geodirectory, wpgeodirectory events calendar* +1 more WordPress Events Calendar for GeoDirectory plugin <= 2.3.14 - PHP Object Injection vulnerability CVE-2025-26967 8.8 HighMarch 3, 2025
• ayecode connect, stiofan ayecode connect +1 more WordPress AyeCode Connect plugin <= 1.3.8 - Broken Access Control vulnerability CVE-2024-56255 4.3 MediumJanuary 2, 2025
• ayecode userswp WordPress UsersWP plugin <= 1.2.15 - Broken Access Control vulnerability CVE-2024-43277 5.3 MediumNovember 1, 2024
• ayecode getpaid WordPress GetPaid plugin <= 2.8.11 - Broken Access Control vulnerability CVE-2024-43973 4.3 MediumNovember 1, 2024
• ayecode userswp UsersWP < 1.2.12 - Users Information Disclosure CVE-2024-6477 7.5 HighAugust 3, 2024
• ayecode ltd userswp WordPress UsersWP plugin < 1.2.6 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-31936 5.4 MediumApril 11, 2024
• ayecode userswp WordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection CVE-2022-47442 5.8 MediumNovember 7, 2023