Stiofansisland vulnerabilities
We track 5 vulnerabilities in Stiofansisland products across 3 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 17, 2026.
Latest Stiofansisland vulnerabilities
- 7.2 High severity
Payment forms, Buy now buttons, and Invoicing…: Improper Neutralization of Input During Web Page Generation
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output
- 8.1 High severity
UsersWP – Front-end login form, User…: Improper Limitation of a Pathname to a Restricted Directory
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload_file_remove() AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $_POST when no real $_
- 8.8 High severity
UsersWP – Front-end login form, User…: Improper Limitation of a Pathname to a Restricted Directory
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.65. This is due to insufficient validation of file-field values in the UsersWP_Validation::validate_fields() function (which falls through to saniti
- 8.8 High severity
Events Calendar for GeoDirectory: Improper Privilege Management
The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajax_ayi_action() handler only applying strip_tags(esc_sql()) — with no allow-list — to the attacker-cont
- 9.8 Critical severity
UsersWP – Front-end login form, User…: Improper Neutralization of Special Elements used in an SQL Command
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insu