Skip to content
Noroxi

wpWax records

24 published records for vendor wpwax.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
29.2%
Median publish → KEV
No record has entered KEV

Records by year

  1. 21
  2. 22
  3. 23
  4. 24
  5. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

24 records
  • CVE-2025-1570
    39Monitor

    Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP

    CriticalCVSS 9.8No exploitEPSS 0%

    wpwax · directoristFeb 28, 2025

  • CVE-2024-2006
    35Monitor

    Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.7 - Authenticated (Contributor+) PHP Object Injection in outpo

    HighCVSS 8.8No exploitEPSS 1%

    wpwax · post grid\, slider \& carousel ultimateMar 13, 2024

  • CVE-2024-1950
    35Monitor

    Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.7 - Authenticated(Contributor+) PHP Object Injection

    HighCVSS 8.8No exploitEPSS 1%

    wpwax · product carousel slider \& grid ultimate for woocommerceMar 13, 2024

  • CVE-2023-1888
    35Monitor

    Directorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalation

    HighCVSS 8.8No exploitEPSS 0%

    wpwax · directoristJun 9, 2023

  • CVE-2024-13409
    35Monitor

    Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion via pos

    HighCVSS 8.8No exploitEPSS 0%

    wpwax · post grid\, slider \& carousel ultimateJan 24, 2025

  • CVE-2023-41798
    35Monitor

    WordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV Injection

    HighCVSS 8.8No exploitEPSS 0%

    wpwax · directoristNov 7, 2023

  • CVE-2025-24782
    35Monitor

    WordPress Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin <= 1.6.10 - Local File Inclusion vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    wpwax · post grid\, slider \& carousel ultimateJan 27, 2025

  • CVE-2023-47824
    35Monitor

    WordPress Legal Pages Plugin <= 1.3.8 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    wpwax · legal pagesNov 22, 2023

  • CVE-2023-50886
    32Monitor

    WordPress Legal Pages plugin <= 1.3.7 - CSRF + Broken Access Control vulnerability

    HighCVSS 8.0No exploitEPSS 0%

    wpwax · legal pagesMar 15, 2024

  • CVE-2024-1951
    30Monitor

    Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid <= 1.3.8 - Authenticated(Contributor+) PHP Object Injection

    HighCVSS 7.5No exploitEPSS 1%

    wpwax · logo showcase ultimate – logo carousel, logo slider & logo gridMar 13, 2024

  • CVE-2021-24981
    30Monitor

    Directorist – Business Directory Plugin < 7.0.6.2 - CSRF to Remote File Upload

    HighCVSS 7.5No exploitEPSS 0%

    wpwax · directoristDec 21, 2021

  • CVE-2022-3961
    26Monitor

    Directorist < 7.4.4 - Subscriber+ Sensitive Information Disclosure

    MediumCVSS 6.5No exploitEPSS 0%

    wpwax · directoristDec 19, 2022

  • CVE-2022-3930
    26Monitor

    Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR

    MediumCVSS 6.5No exploitEPSS 0%

    wpwax · directoristDec 12, 2022

  • CVE-2023-1889
    26Monitor

    Directorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_task

    MediumCVSS 6.5No exploitEPSS 0%

    wpwax · directoristJun 9, 2023

  • CVE-2022-2376
    22Monitor

    Directorist < 7.3.1 - Unauthenticated Email Address Disclosure

    MediumCVSS 5.3Proof of conceptEPSS 1%

    wpwax · directoristSep 5, 2022

  • CVE-2022-34853
    21Monitor

    WordPress Team plugin <= 1.2.6 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities

    MediumCVSS 5.4No exploitEPSS 0%

    wpwax · teamJul 22, 2022

  • CVE-2022-34650
    21Monitor

    WordPress Team plugin <= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

    MediumCVSS 5.4No exploitEPSS 0%

    wpwax · teamJul 22, 2022

  • CVE-2024-1322
    21Monitor

    Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Change

    MediumCVSS 5.3No exploitEPSS 0%

    wpwax · directoristFeb 28, 2024

  • CVE-2024-12041
    21Monitor

    Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings <= 8.0.12 - Unauthenticated User Information Exposure

    MediumCVSS 5.3No exploitEPSS 0%

    wpwax · directoristFeb 1, 2025

  • CVE-2024-29925
    21Monitor

    WordPress Post Grid, Slider & Carousel Ultimate plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.4No exploitEPSS 0%

    wpwax · post grid\, slider \& carousel ultimateMar 27, 2024

  • CVE-2022-2046
    19Monitor

    Directorist - Business Directory Plugin < 7.2.3 - Admin+ Arbitrary File Upload

    MediumCVSS 4.9No exploitEPSS 1%

    wpwax · directoristAug 8, 2022

  • CVE-2022-1266
    19Monitor

    Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS

    MediumCVSS 4.8No exploitEPSS 0%

    wpwax · post grid\, slider \& carousel ultimateJun 20, 2022

  • CVE-2022-2377
    17Monitor

    Directorist < 7.3.0 - Subscriber+ Arbitrary E-mail Sending

    MediumCVSS 4.3No exploitEPSS 0%

    wpwax · directoristAug 22, 2022

  • CVE-2023-2252
    10Monitor

    Directorist < 7.5.4 - Admin+ LFI

    LowCVSS 2.7Proof of conceptEPSS 1%

    wpwax · directoristJan 16, 2024