Wpexperts vulnerabilities
We track 8 vulnerabilities in Wpexperts products across 4 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on November 16, 2024.
Latest Wpexperts vulnerabilities
- 9.9 Critical severity
User Management: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in Saad Iqbal User Management user-management allows Upload a Web Shell to a Web Server.This issue affects User Management: from n/a through <= 1.1.
- 7.2 High severity
Post SMTP – Complete Email Deliverability and…: Improper Neutralization of Special Elements used in an SQL Command
The POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for WordPress is vulnerable to time-based SQL Injection via the selected parameter in all versions up to, and including, 2.9.3 due to insufficien
- 7.2 High severity
POST SMTP Mailer: Improper Neutralization of Special Elements used in an SQL Command
The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several parameters before using them in SQL statements, leading to a SQL injection exploitable by high privilege users such as admin.
- 9.8 Critical severity
Post SMTP – Complete Email Deliverability and…: Missing Authorization
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all ve
- 8.8 High severity
Email Templates Customizer and Designer for…: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-templates allows Cross Site Request Forgery.This issue affects Email Templates Customizer and Designer for WordPress and
- 8.8 High severity
POST SMTP Mailer: Cross-Site Request Forgery
The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a passwor
- 7.2 High severity
Post SMTP Mailer/Email Log: Server-Side Request Forgery
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example.
- 7.5 High severity
Change wp-admin login: Cross-Site Request Forgery
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed vi