Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 22

Export CSV
CVE-2026-19615

Admin and Site Enhancements < 9.0.1 - Author+ Stored XSS via SVG Upload over XML-RPC

The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who opens it.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bowo Wordpress
Products
Admin And Site Enhancements Ase Wordpress
CVE-2024-33915

WordPress Debug Log Manager plugin <= 2.3.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bowo Wordpress
Products
Debug Log Manager Wordpress
CVE-2024-32582

WordPress Debug Log Manager plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bowo Debug Log Manager allows Stored XSS.This issue affects Debug Log Manager: from n/a through 2.3.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Bowo Wordpress
Products
Debug Log Manager Wordpress
CVE-2023-6136

WordPress Debug Log Manager Plugin <= 2.3.0 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bowo
Products
Debug Log Manager
CVE-2025-64255

WordPress Admin and Site Enhancements (ASE) plugin <= 8.0.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 8.0.8.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Bowo Wordpress
Products
Admin And Site Enhancements Ase Wordpress
CVE-2025-32613

WordPress Debug Log Manager plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bowo Debug Log Manager debug-log-manager allows Stored XSS.This issue affects Debug Log Manager: from n/a through <= 2.3.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Bowo Wordpress
Products
Debug Log Manager Wordpress
CVE-2025-26911

WordPress System Dashboard plugin <= 2.8.18 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bowo System Dashboard system-dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects System Dashboard: from n/a through <= 2.8.18.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bowo Wordpress
Products
System Dashboard Wordpress
CVE-2026-32423

WordPress Admin and Site Enhancements (ASE) plugin <= 8.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 8.4.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Bowo Wordpress
Products
Admin And Site Enhancements Ase Wordpress
CVE-2025-10377

System Dashboard <= 2.8.20 - Cross-Site Request Forgery

The System Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.20. This is due to missing nonce validation on the sd_toggle_logs() function. This makes it possible for unauthenticated attackers to toggle critical logging settings including Page Access Logs, Error Logs, and Email Delivery Logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bowo Wordpress
Products
System Dashboard Wordpress
CVE-2023-5713

System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_option_value)

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve potentially sensitive option values, and deserialize the content of those values.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bowo
Products
System Dashboard
CVE-2023-5710

System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_constants)

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information such as database credentials.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bowo
Products
System Dashboard
CVE-2024-12299

System Dashboard <= 2.8.17 - Reflected Cross-Site Scripting via Filename Parameter

The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, and including, 2.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Bowo
Products
System Dashboard
CVE-2023-5816

Code Explorer <= 1.4.5 - Authenticated (Admin+) External File Reading

The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading in all versions up to, and including, 1.4.5. This is due to the fact that the plugin does not restrict accessing files to those outside of the WordPress instance, though the intention of the plugin is to only access WordPress related files. This makes it possible for authenticated attackers, with administrator-level access, to read files outside of the WordPress instance.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Bowo
Products
Code Explorer
CVE-2023-5772

Debug Log Manager <= 2.2.0 - Cross-Site Request Forgery

The Debug Log Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the clear_log() function. This makes it possible for unauthenticated attackers to clear the debug log via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bowo
Products
Debug Log Manager
CVE-2023-5714

System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_db_specs)

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve data key specs.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bowo
Products
System Dashboard
CVE-2023-5712

System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_global_value)

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive global value information.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bowo
Products
System Dashboard
CVE-2023-5711

System Dashboard <= 2.8.8 - Missing Authorization to Information Disclosure (sd_php_info)

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information provided by PHP info.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bowo
Products
System Dashboard
CVE-2024-11107

System Dashboard < 2.8.15 - Unauthenticated Stored XSS

The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Bowo
Products
System Dashboard
CVE-2024-10708

System Dashboard < 2.8.15 - Admin+ Path Traversal

The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server

CVSS 3.1 · 4.9 Medium EPSS 2.0% KEV · Not listed
Vendors
Bowo
Products
System Dashboard
CVE-2023-7246

System Dashboard < 2.8.10 - XSS via Header Injection

The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Bowo
Products
System Dashboard