10
Vendor
10up
22
CVEs
0
On KEV
6
New 30D
Products
DI5.4
Distributor
10up
3 CVEs0 on KEV3 new
SS7.5
Safe SVG
10up
6 CVEs0 on KEV2 new
RS5.3
Restricted Site Access
10up
2 CVEs0 on KEV1 new
EL5.3
ElasticPress
10up
3 CVEs0 on KEV0 new
SL8.8
Simple Local Avatars
10up
3 CVEs0 on KEV0 new
ED6.5
Eight Day Week Print Workflow
10up
2 CVEs0 on KEV0 new
AF5.4
Autoshare for Twitter
10up
1 CVEs0 on KEV0 new
MA5.4
Microsoft Azure Storage for WordPress
10up
1 CVEs0 on KEV0 new
SP5.3
Simple Page Ordering
10up
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111631 | DI Distributor 10up | 5.4 | Oct 16 | Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions |
| CVE-2026-111628 | DI Distributor 10up | 5.0 | Oct 16 | 10up Distributor before 2.3.2 PHP Object Injection via set_meta() |
| CVE-2026-111625 | DI Distributor 10up | 5.0 | Oct 16 | 10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action |
| CVE-2026-110227 | RS Restricted Site Access 10up | 5.3 | Oct 14 | WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability |
| CVE-2026-94672 | SS Safe SVG 10up | 4.3 | Sep 30 | WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-94077 | SS Safe SVG 10up | 6.5 | Sep 30 | WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-62088 | EL ElasticPress 10up | 5.3 | Sep 11 | WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability |
| CVE-2026-5028 | ED Eight Day Week Print Workflow 10up | 6.5 | May 12 | Eight Day Week Print Workflow <= 1.2.6 - Authenticated (Subscriber+) SQL Injection via 'title' Parameter |
| CVE-2026-25311 | AF Autoshare for Twitter 10up | 5.4 | Feb 19 | WordPress Autoshare for Twitter plugin <= 2.3.1 - Broken Access Control vulnerability |
| CVE-2025-67621 | ED Eight Day Week Print Workflow 10up | 4.3 | Dec 24 | WordPress Eight Day Week Print Workflow plugin <= 1.2.5 - Sensitive Data Exposure vulnerability |
| CVE-2025-10749 | MA Microsoft Azure Storage for WordPress 10up | 5.4 | Oct 24 | Microsoft Azure Storage for WordPress <= 4.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion |
| CVE-2025-8482 | SL Simple Local Avatars 10up | 4.3 | Aug 12 | Simple Local Avatars <= 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Avatar Migration |
| CVE-2023-32798 | SP Simple Page Ordering 10up | 5.3 | Dec 13 | WordPress Simple Page Ordering plugin <= 2.5.0 - Broken Access Control vulnerability |
| CVE-2024-10786 | SL Simple Local Avatars 10up | 4.3 | Nov 16 | Simple Local Avatars <= 2.7.11 - Missing Authorization to Authenticated (Subscriber+) User Cache Clearing |
| CVE-2024-8378 | SS Safe Svg 10up | 4.8 | Nov 7 | Safe SVG < 2.2.6 - Author+ SVG Sanitisation Bypass |
| CVE-2024-43116 | SL Simple Local Avatars 10up | 8.8 | Aug 26 | WordPress Simple Local Avatars plugin <= 2.7.10 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2024-35684 | EL ElasticPress 10up | 4.3 | Jun 8 | WordPress ElasticPress plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2023-48753 | RS Restricted Site Access 10up | 5.3 | Jun 4 | WordPress Restricted Site Access plugin <= 7.4.1 - IP Restriction Bypass vulnerability |
| CVE-2021-4405 | EL Elasticpress 10up | 4.3 | Jul 1 | The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3 |
| CVE-2022-1613 | RS Restricted Site Access 10up | 5.3 | Sep 26 | The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass… |
| CVE-2022-1091 | SS Safe Svg 10up | 6.1 | Apr 18 | The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file |
| CVE-2019-18855 | SS Safe Svg 10up | 7.5 | Nov 11 | A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributes |
| CVE-2019-18854 | SS Safe Svg 10up | 7.5 | Nov 11 | A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use |