Simple:Press Forum
simplepress · plugin
Known security vulnerabilities for Simple:Press Forum. Find out in seconds which version runs on your site with WP Lens.
8 known vulnerabilities
5 exploitable without logging in · latest Mar 31, 2025
Listed on wordpress.org · latest 6.11.15 · last updated Sep 17, 2026 · 300+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- High 8.1
CVE-2022-4030subscriber+≤ 6.8
Simple:Press <= 6.8 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Deletion
- Medium 6.1
CVE-2024-12409unauthenticated · needs a click≤ 6.10.11
Simple:Press Forum <= 6.10.11 - Reflected Cross-Site Scripting
- Medium 5.4
CVE-2022-4027unauthenticated≤ 6.8
Simple:Press <= 6.8 - Unauthenticated Stored Cross-Site Scripting via Forum Replies
- Medium 5.4
CVE-2022-4028subscriber+≤ 6.8
Simple:Press <= 6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Signatures
- Medium 5.3
CVE-2025-31386unauthenticated≤ 6.11.5
WordPress Simple:Press plugin <= 6.11.5 - Broken Access Control vulnerability
- Medium 4.9
CVE-2022-4031admin≤ 6.8
Simple:Press <= 6.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Modification
- Medium 4.7
CVE-2022-4029unauthenticated · needs a click≤ 6.8
Simple:Press <= 6.8 - Reflected Cross-Site Scripting via Cookie Value
- Medium 4.3
CVE-2024-13518unauthenticated · needs a click≤ 6.10.12
Simple:Press <= 6.10.12 - Cross-Site Request Forgery to Unauthorized Post Editing
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).