Stiofansisland vulnerabilities

Products

• Userswp – Front-end Login Form, User Registration, User Profile & Members Directory Plugin For Wp 13
• Payment Forms, Buy Now Buttons, And Invoicing System | Getpaid 5

Newest

• stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp UsersWP <= 1.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode Attribute CVE-2026-120671 6.4 MediumNovember 6, 2026
• ayecode ltd payment forms, buy now buttons, and invoicing system | getpaid GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass CVE-2026-119749 8.7 HighNovember 4, 2026
• ayecode ltd payment forms, buy now buttons, and invoicing system | getpaid GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice CVE-2026-119748 6.9 MediumNovember 4, 2026
• ayecode ltd payment forms, buy now buttons, and invoicing system | getpaid GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API CVE-2026-119747 7.1 HighNovember 4, 2026
• stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash CVE-2026-119980 6.5 MediumOctober 31, 2026
• stiofansisland payment forms, buy now buttons, and invoicing system | getpaid Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter CVE-2026-111110 7.2 HighOctober 17, 2026
• stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion CVE-2026-19991 8.1 HighSeptember 11, 2026
• stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution CVE-2026-18501 6.4 MediumAugust 6, 2026
• stiofansisland payment forms, buy now buttons, and invoicing system | getpaid Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field CVE-2026-17605 6.6 MediumAugust 1, 2026
• stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field CVE-2026-13492 8.8 HighJuly 9, 2026
• stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter CVE-2026-12102 2.7 LowJune 18, 2026
• stiofan events calendar for geodirectory Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation CVE-2026-11616 8.8 HighJune 9, 2026
• stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter CVE-2026-4979 5.0 MediumApril 11, 2026
• stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter CVE-2026-4977 4.3 MediumApril 10, 2026
• stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution CVE-2026-5742 6.4 MediumApril 9, 2026
• stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection CVE-2025-10003 6.5 MediumSeptember 6, 2025
• stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-9344 6.4 MediumAugust 28, 2025
• ayecode userswp, stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp +1 more UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by' CVE-2024-6265 9.8 CriticalJune 29, 2024
• ayecode userswp, stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp +1 more UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-2423 6.4 MediumApril 9, 2024