ST
Vendor
stiofansisland
12
CVEs
0
On KEV
1
New 30D
Products
PF7.2
Payment forms, Buy now buttons, and Invoicing System | GetPaid
stiofansisland
2 CVEs0 on KEV1 new
UF8.8
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
stiofansisland
9 CVEs0 on KEV0 new
EC8.8
Events Calendar for GeoDirectory
stiofansisland
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111110 | PF Payment forms, Buy now buttons, and Invoicing System | GetPaid stiofansisland | 7.2 | Oct 17 | Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter |
| CVE-2026-19991 | UF UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP stiofansisland | 8.1 | Sep 11 | UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion |
| CVE-2026-18501 | UF UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP stiofansisland | 6.4 | Aug 6 | UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution |
| CVE-2026-17605 | PF Payment forms, Buy now buttons, and Invoicing System | GetPaid stiofansisland | 6.6 | Aug 1 | Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field |
| CVE-2026-13492 | UF UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP stiofansisland | 8.8 | Jul 9 | UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field |
| CVE-2026-12102 | UF UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP stiofansisland | 2.7 | Jun 18 | UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter |
| CVE-2026-11616 | EC Events Calendar for GeoDirectory stiofansisland | 8.8 | Jun 9 | Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation |
| CVE-2026-4979 | UF UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP stiofansisland | 5.0 | Apr 11 | UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter |
| CVE-2026-4977 | UF UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP stiofansisland | 4.3 | Apr 10 | UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter |
| CVE-2026-5742 | UF UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP stiofansisland | 6.4 | Apr 9 | UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution |
| CVE-2025-10003 | UF UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP stiofansisland | 6.5 | Sep 6 | UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection |
| CVE-2025-9344 | UF UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP stiofansisland | 6.4 | Aug 28 | UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting |