Rafasashi vulnerabilities
We track 3 vulnerabilities in Rafasashi products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 15, 2026.
Latest Rafasashi vulnerabilities
- 9.8 Critical severity
User Session Synchronizer: Improper Authentication
The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The `synchronize_session()` function, hooked on `init` and therefore executed on every request, p
- 7.1 High severity
User Session Synchronizer: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in rafasashi User Session Synchronizer user-session-synchronizer allows Stored XSS.This issue affects User Session Synchronizer: from n/a through <= 1.4.0.
- 7.1 High severity
SVG Captcha: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafasashi SVG Captcha svg-captcha allows Reflected XSS.This issue affects SVG Captcha: from n/a through <= 1.0.11.