Export limit exceeded: 425822 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2025-62109

WordPress Geo Controller plugin <= 8.9.4 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in INFINITUM FORM Geo Controller cf-geoplugin allows Retrieve Embedded Sensitive Data.This issue affects Geo Controller: from n/a through <= 8.9.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Infinitumform Wordpress
Products
Geo Controller Wordpress
CVE-2023-51513

WordPress Geo Controller plugin <= 8.5.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in INTINITUM FORM Geo Controller allows DOM-Based XSS.This issue affects Geo Controller: from n/a through 8.5.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Infinitumform Wordpress
Products
Geo Controller Wordpress
CVE-2024-7381

Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution

The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajax__shortcode_cache function in all versions up to, and including, 8.6.9. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the target site.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Infinitumform Wordpress
Products
Geo Controller Geo Controller
CVE-2024-7380

Geo Controller <= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion

The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajax__geolocate_menu and ajax__geolocate_remove_menu functions in all versions up to, and including, 8.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or delete WordPress menus.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Infinitumform
Products
Geo Controller
CVE-2024-3591

WordPress Geo Controller < 8.6.5 - PHP Object Injection

The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Infinitumform
Products
Geo Controller