Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 19

Export CSV
CVE-2026-112359

WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerability

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Amauri Wordpress-extensions
Products
Wpmobile.app Wpmobile.app
CVE-2026-111714

tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge

tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Amauri
Products
Tarteaucitronjs
CVE-2026-111713

tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Amauri
Products
Tarteaucitronjs
CVE-2026-94541

WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the push queue by the mail-to-push feature, and use those URLs to take over the targeted accounts. This exploit chain requires the plugin's mail-to-push feature (wpmobile_auto_mail=1) to be enabled, as that setting is what causes outbound WordPress password-reset emails — including the reset URL and key — to be mirrored into the push row queue where they become accessible to the attacker.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Amauri Wordpress-extensions
Products
Wpmobile.app Wpmobile.app
CVE-2026-96342

WordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Amauri Wordpress-extensions
Products
Wpmobile.app Wpmobile.app
CVE-2026-61984

WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Amauri Wordpress
Products
Wpmobile.app Wordpress
CVE-2026-49977

tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies

tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by tarteaucitron. If an attacker can write HTML with data attributes, an element with data-cookie can silently delete a non-HttpOnly cookie with a known name when clicked by a user. This issue is fixed in version 1.33.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Amauri
Products
Tarteaucitronjs
CVE-2024-35694

WordPress WPMobile.App plugin <= 11.41 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects WPMobile.App: from n/a through <= 11.41.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Amauri
Products
Wpmobile.app
CVE-2026-22809

tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability

tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.29.0, a Regular Expression Denial of Service (ReDoS) vulnerability was identified in tarteaucitron.js in the handling of the issuu_id parameter. This vulnerability is fixed in 1.29.0.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Amauri
Products
Tarteaucitronjs
CVE-2025-62074

WordPress WPMobile.App plugin <= 11.71 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects WPMobile.App: from n/a through <= 11.71.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Amauri Wordpress
Products
Wpmobile.app Wordpress
CVE-2024-13888

WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameter

The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the redirect URL supplied via the 'redirect' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Amauri
Products
Wpmobile.app
CVE-2025-31475

tarteaucitron.js allows prototype pollution via custom text injection

tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where the addOrUpdate function, used for applying custom texts, did not properly validate input. This allowed an attacker with direct access to the site's source code or a CMS plugin to manipulate JavaScript object prototypes, leading to potential security risks such as data corruption or unintended code execution. An attacker with high privileges could exploit this vulnerability to modify object prototypes, affecting core JavaScript behavior, cause application crashes or unexpected behavior, or potentially introduce further security vulnerabilities depending on the application's architecture. This vulnerability is fixed in 1.20.1.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Amauri
Products
Tarteaucitronjs
CVE-2025-48939

tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript

tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML element, it could clobber the document.currentScript property. This causes the script to resolve incorrectly to an element instead of the <script> tag, leading to unexpected behavior or failure to load the script path correctly. This issue arises because in some browser environments, named DOM elements become properties on the global document object. An attacker with control over the HTML could exploit this to change the CDN domain of tarteaucitron. This issue has been patched in version 1.22.0.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Amauri
Products
Tarteaucitronjs
CVE-2025-31138

tarteaucitron.js allows UI manipulation via unrestricted CSS injection

tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions (width and height) were not properly validated. This allowed an attacker with direct access to the site's source code or a CMS plugin to set values like 100%;height:100%;position:fixed;, potentially covering the entire viewport and facilitating clickjacking attacks. An attacker with high privileges could exploit this vulnerability to overlay malicious UI elements on top of legitimate content, trick users into interacting with hidden elements (clickjacking), or disrupt the intended functionality and accessibility of the website. This vulnerability is fixed in 1.20.1.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Amauri
Products
Tarteaucitronjs
CVE-2025-31476

tarteaucitron.js allows url scheme injection via unfiltered inputs

tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site's source code or a CMS plugin) to enter a URL containing an insecure scheme such as javascript:alert(). Before the fix, URL validation was insufficient, which could allow arbitrary JavaScript execution if a user clicked on a malicious link. An attacker with high privileges could insert a link exploiting an insecure URL scheme, leading to execution of arbitrary JavaScript code, theft of sensitive data through phishing attacks, or modification of the user interface behavior. This vulnerability is fixed in 1.20.1.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Amauri Tacjs Project
Products
Tarteaucitronjs Tacjs
CVE-2025-4955

tarteaucitron.io < 1.9.5 - Contributor+ Stored XSS

The tarteaucitron.io WordPress plugin before 1.9.5 uses query parameters from YouTube oEmbed URLs without sanitizing these parameters correctly, which could allow users with the contributor role and above to perform Stored Cross-site Scripting attacks.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Amauri
Products
Tarteaucitron.io
CVE-2023-22702

WordPress WPMobile.App — Android and iOS Mobile Application Plugin <= 11.13 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in WPMobile.App WPMobile.App — Android and iOS Mobile Application plugin <= 11.13 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Amauri
Products
Wpmobile.app
CVE-2023-28932

WordPress WPMobile.App Plugin <= 11.20 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPMobile.App WPMobile.App — Android and iOS Mobile Application plugin <= 11.20 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Amauri
Products
Wpmobile.app
CVE-2023-26010

WordPress WPMobile.App Plugin <= 11.18 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPMobile.App plugin <= 11.18 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Amauri
Products
Wpmobile.app