Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-65440

WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Roxnor Wordpress
Products
Getgenie Wordpress
CVE-2026-57316

WordPress GetGenie plugin <= 4.4.2 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Roxnor Wordpress
Products
Getgenie Wordpress
CVE-2026-2257

GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API

The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2 due to missing validation on a user controlled key in the `action` function. This makes it possible for authenticated attackers, with Author-level access and above, to update post metadata for arbitrary posts. Combined with a lack of input sanitization, this leads to Stored Cross-Site Scripting when a higher-privileged user (such as an Administrator) views the affected post's "Competitor" tab in the GetGenie sidebar.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Roxnor Wordpress
Products
Getgenie – Ai Content Writer With Keyword Research & Seo Tracking Tools Wordpress
CVE-2026-2879

GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion

The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2. This is due to missing validation on the `id` parameter in the `create()` method of the `GetGenieChat` REST API endpoint. The method accepts a user-controlled post ID and, when a post with that ID exists, calls `wp_update_post()` without verifying that the current user owns the post or that the post is of the expected `getgenie_chat` type. This makes it possible for authenticated attackers, with Author-level access and above, to overwrite arbitrary posts owned by any user — including Administrators — effectively destroying the original content by changing its `post_type` to `getgenie_chat` and reassigning `post_author` to the attacker.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Roxnor Wordpress
Products
Getgenie – Ai Content Writer With Keyword Research & Seo Tracking Tools Wordpress