Skip to content
Noroxi

WPExperts records

50 published records for vendor wpexperts.

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 2%
Pre-auth RCE
0
With a fix record
42%
Median publish → KEV
No record has entered KEV

Records by year

  1. 21
  2. 22
  3. 23
  4. 24
  5. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

50 records
  • CVE-2023-6875
    66This week

    POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API

    CriticalCVSS 9.8WeaponizedEPSS 90%

    wpexperts · post smtpJan 11, 2024

  • CVE-2024-52403
    39Monitor

    WordPress User Management plugin <= 1.1 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.9No exploitEPSS 0%

    saad iqbal · user managementNov 16, 2024

  • CVE-2023-52233
    39Monitor

    WordPress POST SMTP Mailer plugin <= 2.8.6 - Broken Access Control on API vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    wpexperts · post smtpJun 11, 2024

  • CVE-2021-24755
    35Monitor

    myCred < 2.3 - Subscriber+ SQL Injection

    HighCVSS 8.8No exploitEPSS 1%

    wpexperts · mycredNov 29, 2021

  • CVE-2019-25150
    35Monitor

    Email Templates <= 1.3 - HTML Injection

    HighCVSS 8.8No exploitEPSS 1%

    wpexperts · email templatesJun 6, 2023

  • CVE-2025-22800
    35Monitor

    WordPress Post SMTP plugin <= 2.9.11 - Broken Access Control vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    wpexperts · post smtpJan 13, 2025

  • CVE-2023-3179
    35Monitor

    POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF

    HighCVSS 8.8No exploitEPSS 0%

    wpexperts · post smtpJul 17, 2023

  • CVE-2022-47181
    35Monitor

    WordPress Email Templates Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    wpexperts · email templates customizer and designerNov 7, 2023

  • CVE-2023-35096
    35Monitor

    WordPress myCred Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    wpexperts · mycredJul 17, 2023

  • CVE-2023-35038
    35Monitor

    WordPress WP PDF Generator Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    wpexperts · wp pdf generatorJul 17, 2023

  • CVE-2023-50902
    35Monitor

    WordPress New User Approve Plugin <= 2.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    wpexperts · new user approveDec 29, 2023

  • CVE-2023-6620
    32Monitor

    Post SMTP < 2.8.7 - Admin+ SQL Injection

    HighCVSS 7.2No exploitEPSS 14%

    wpexperts · post smtpJan 15, 2024

  • CVE-2023-3604
    30Monitor

    Change WP Admin < 1.1.4 - Secret Login Page Disclosure

    HighCVSS 7.5No exploitEPSS 0%

    wpexperts · all in one loginAug 21, 2023

  • CVE-2022-1589
    30Monitor

    Change wp-admin Login < 1.1.0 - Unauthenticated Arbitrary Settings Update

    HighCVSS 7.5No exploitEPSS 0%

    wpexperts · all in one loginMay 30, 2022

  • CVE-2022-2352
    28Monitor

    Post SMTP < 2.1.7 - Admin+ Blind SSRF

    HighCVSS 7.2No exploitEPSS 1%

    wpexperts · post smtpSep 26, 2022

  • CVE-2023-48742
    28Monitor

    WordPress License Manager for WooCommerce Plugin <= 2.2.10 is vulnerable to SQL Injection

    HighCVSS 7.2No exploitEPSS 0%

    wpexperts · license manager for woocommerceNov 30, 2023

  • CVE-2024-5207
    28Monitor

    POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection

    HighCVSS 7.2No exploitEPSS 0%

    wpexperts · post smtpMay 30, 2024

  • CVE-2024-52436
    28Monitor

    WordPress Post SMTP plugin <= 2.9.9 - SQL Injection vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    wpexperts · post smtpNov 18, 2024

  • CVE-2024-13713
    26Monitor

    WPExperts Square For GiveWP <= 1.3.1 - Authenticated (Subscriber+) SQL Injection

    MediumCVSS 6.5No exploitEPSS 0%

    wpexperts · givewp squareFeb 21, 2025

  • CVE-2024-1639
    26Monitor

    License Manager for WooCommerce <= 3.0.6 - Improper Authorization to Authenticated(Contributor+) Sensitive Information Exposure

    MediumCVSS 6.5No exploitEPSS 0%

    wpexperts · license manager for woocommerceJun 20, 2024

  • CVE-2023-5958
    24Monitor

    POST SMTP Mailer < 2.7.1 - Unauthenticated Cross-site Scripting

    MediumCVSS 6.1No exploitEPSS 0%

    wpexperts · post smtpNov 27, 2023

  • CVE-2023-3082
    24Monitor

    Post SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email

    MediumCVSS 6.1No exploitEPSS 0%

    wpexperts · post smtpJul 12, 2023

  • CVE-2023-6629
    24Monitor

    POST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msg

    MediumCVSS 6.1No exploitEPSS 0%

    wpexperts · post smtpJan 3, 2024

  • CVE-2023-6621
    24Monitor

    Post SMTP < 2.8.7 - Reflected Cross-Site Scripting

    MediumCVSS 6.1No exploitEPSS 0%

    wpexperts · post smtpJan 3, 2024

  • CVE-2024-29128
    24Monitor

    WordPress POST SMTP Mailer plugin <= 2.8.6 - Reflected Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.1No exploitEPSS 0%

    wpexperts · post smtpMar 19, 2024