wpvibes records

14 published records for vendor wpvibes.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 71.4%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

14 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
38Monitor	CVE-2023-5674No exploit	WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs/send_mail endpointwpvibes · wp mail log · CWE-89 SQL injection	High8.8	—	10.8%	Dec 26, 2023
35Monitor	CVE-2023-5673No exploit	WP Mail Log < 1.1.3 – Contributor+ Arbitrary File Upload to RCEwpvibes · wp mail log · CWE-434 RCE File upload	High8.8	—	1.0%	Dec 26, 2023
35Monitor	CVE-2023-5645No exploit	WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs endpointwpvibes · wp mail log · CWE-89 SQL injection	High8.8	—	0.7%	Dec 26, 2023
35Monitor	CVE-2023-51410No exploit	WordPress WP Mail Log Plugin <= 1.1.2 is vulnerable to Arbitrary File Uploadwpvibes · wp mail log · CWE-434 File upload	High8.8	—	0.6%	Dec 29, 2023
35Monitor	CVE-2022-45807No exploit	WordPress WP Mail Log Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF)wpvibes · wp mail log · CWE-352 Pre-auth CSRF	High8.8	—	0.2%	Feb 2, 2023
30Monitor	CVE-2023-5644No exploit	WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpointswpvibes · wp mail log · CWE-863 Broken access control (IDOR)	High7.6	—	0.4%	Dec 26, 2023
28Monitor	CVE-2022-3764No exploit	Form Vibes < 1.4.5 - Admin+ SQLiwpvibes · form vibes · CWE-89 SQL injection	High7.2	—	0.9%	Jan 16, 2024
28Monitor	CVE-2023-47530No exploit	WordPress Redirect 404 Error Page to Homepage or Custom Page with Logs Plugin <= 1.8.7 is vulnerable to SQL Injectionwpvibes · redirect 404 error page to homepage or custom page with logs · CWE-89 SQL injection	High7.2	—	0.7%	Dec 18, 2023
26Monitor	CVE-2023-5672No exploit	WP Mail Log < 1.1.3 – Contributor+ LFI in wml_logs/send_mail endpointwpvibes · wp mail log · CWE-22 Path traversal	Medium6.5	—	0.7%	Dec 26, 2023
26Monitor	CVE-2021-24767No exploit	Redirect 404 Error Page to Homepage or Custom Page with Logs < 1.7.9 - Log Deletion via CSRFwpvibes · redirect 404 error page to homepage or custom page with logs · CWE-352 Pre-auth CSRF	Medium6.5	—	0.5%	Nov 8, 2021
26Monitor	CVE-2024-5325No exploit	Form Vibes <= 1.4.10 - Authenticated (Subscriber+) SQL Injection via fv_export_datawpvibes · form vibes · CWE-89 SQL injection	Medium6.5	—	0.4%	Jul 12, 2024
24Monitor	CVE-2023-3088No exploit	WP Mail Log <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting via Emailwpvibes · wp mail log · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Jul 12, 2023
21Monitor	CVE-2023-0443No exploit	AnyWhere Elementor < 1.2.8 - Freemius API Key Disclosurewpvibes · anywhere elementor · CWE-200 Pre-auth Info leak	Medium5.3	—	0.6%	May 30, 2023
21Monitor	CVE-2024-5309No exploit	Form Vibes – Database Manager for Forms <= 1.4.12 - Missing Authorization in Multiple Functionswpvibes · form vibes · CWE-862 Broken access control (IDOR)	Medium5.4	—	0.2%	Sep 5, 2024

CVE-2023-5674
38Monitor
WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs/send_mail endpoint
HighCVSS 8.8No exploitEPSS 10%
- SQL injection
wpvibes · wp mail logDec 26, 2023
CVE-2023-5673
35Monitor
WP Mail Log < 1.1.3 – Contributor+ Arbitrary File Upload to RCE
HighCVSS 8.8No exploitEPSS 1%
- RCE
- File upload
wpvibes · wp mail logDec 26, 2023
CVE-2023-5645
35Monitor
WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs endpoint
HighCVSS 8.8No exploitEPSS 0%
- SQL injection
wpvibes · wp mail logDec 26, 2023
CVE-2023-51410
35Monitor
WordPress WP Mail Log Plugin <= 1.1.2 is vulnerable to Arbitrary File Upload
HighCVSS 8.8No exploitEPSS 0%
- File upload
wpvibes · wp mail logDec 29, 2023
CVE-2022-45807
35Monitor
WordPress WP Mail Log Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF)
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
wpvibes · wp mail logFeb 2, 2023
CVE-2023-5644
30Monitor
WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
wpvibes · wp mail logDec 26, 2023
CVE-2022-3764
28Monitor
Form Vibes < 1.4.5 - Admin+ SQLi
HighCVSS 7.2No exploitEPSS 0%
- SQL injection
wpvibes · form vibesJan 16, 2024
CVE-2023-47530
28Monitor
WordPress Redirect 404 Error Page to Homepage or Custom Page with Logs Plugin <= 1.8.7 is vulnerable to SQL Injection
HighCVSS 7.2No exploitEPSS 0%
- SQL injection
wpvibes · redirect 404 error page to homepage or custom page with logsDec 18, 2023
CVE-2023-5672
26Monitor
WP Mail Log < 1.1.3 – Contributor+ LFI in wml_logs/send_mail endpoint
MediumCVSS 6.5No exploitEPSS 0%
- Path traversal
wpvibes · wp mail logDec 26, 2023
CVE-2021-24767
26Monitor
Redirect 404 Error Page to Homepage or Custom Page with Logs < 1.7.9 - Log Deletion via CSRF
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- CSRF
wpvibes · redirect 404 error page to homepage or custom page with logsNov 8, 2021
CVE-2024-5325
26Monitor
Form Vibes <= 1.4.10 - Authenticated (Subscriber+) SQL Injection via fv_export_data
MediumCVSS 6.5No exploitEPSS 0%
- SQL injection
wpvibes · form vibesJul 12, 2024
CVE-2023-3088
24Monitor
WP Mail Log <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting via Email
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
wpvibes · wp mail logJul 12, 2023
CVE-2023-0443
21Monitor
AnyWhere Elementor < 1.2.8 - Freemius API Key Disclosure
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Info leak
wpvibes · anywhere elementorMay 30, 2023
CVE-2024-5309
21Monitor
Form Vibes – Database Manager for Forms <= 1.4.12 - Missing Authorization in Multiple Functions
MediumCVSS 5.4No exploitEPSS 0%
- Broken access control (IDOR)
wpvibes · form vibesSep 5, 2024