Simplepress - vulnerabilities (CVEs)
10 CVEs in 2 products, 0 in the last 30 days, newest from 2025-03-31.
Products
- Simplepress Forum - 8 CVEs
- Simplepress - 3 CVEs
Newest CVEs of Simplepress
- CVE-2025-31386 - CVSS 5.3 (medium), 2025-03-31: Missing Authorization vulnerability in simplepress Simple:Press simplepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue…
- CVE-2024-13518 - CVSS 4.3 (medium), 2025-03-01: The Simple:Press Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.10.12. This is due to missing…
- CVE-2024-10483 - CVSS 7.1 (high), 2025-02-26: The Simple:Press Forum WordPress plugin before 6.10.11 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected…
- CVE-2024-12409 - CVSS 6.1 (medium), 2025-01-30: The Simple:Press Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including,…
- CVE-2020-36706 - CVSS 9.8 (critical), 2023-10-20: The Simple:Press – WordPress Forum Plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the…
- CVE-2022-4031 - CVSS 4.9 (medium), 2022-11-29: The Simple:Press plugin for WordPress is vulnerable to arbitrary file modifications in versions up to, and including, 6.8 via the 'file' parameter which does…
- CVE-2022-4027 - CVSS 7.2 (high), 2022-11-29: The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during a forum response in…
- CVE-2022-4030 - CVSS 8.1 (high), 2022-11-29: The Simple:Press plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 6.8 via the 'file' parameter which can be manipulated…
- CVE-2022-4029 - CVSS 4.7 (medium), 2022-11-29: The Simple:Press plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sforum_[md5 hash of the WordPress URL]' cookie value in…
- CVE-2022-4028 - CVSS 6.4 (medium), 2022-11-29: The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during the profile-save action…
