Filtered by vendor Wordpress-extensions
Subscriptions
Filtered by product Create
Subscriptions
Total
4 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-125045 | 2 John-michael L'allier, Wordpress-extensions | 2 Create, Create | 2026-11-15 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John-Michael L'Allier Create mediavine-create allows Stored XSS.This issue affects Create: from n/a through 3.1.1. | ||||
| CVE-2026-125046 | 2 John-michael L'allier, Wordpress-extensions | 2 Create, Create | 2026-11-15 | 5.3 Medium |
| Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create: from n/a through 3.1.1. | ||||
| CVE-2026-16992 | 1 Wordpress-extensions | 1 Create | 2026-11-11 | 6.5 Medium |
| The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available. | ||||
| CVE-2026-18037 | 1 Wordpress-extensions | 1 Create | 2026-11-11 | 6.5 Medium |
| The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available. | ||||
Page 1 of 1.