Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-15260

Geo My WP < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR

The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Geo My Wp Wordpress
Products
Geo My Wp Wordpress
CVE-2024-6330

GEO my WordPress < 4.4.0.2 - Unauthenticated RCE via LFI

The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files in PHP's execution context, which leads to Remote Code Execution.

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed
Vendors
Geo My Wp Geomywp
Products
Geo My Wp Geo My Wordpress