Crowd Favorite vulnerabilities and threats

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.3	EPSS 0.2%	CVE-2026-115607DXP ToolKit (WordPress plugin) · SQL Injection Critical9.3EPSS 0.2%2026-10-28CVE Database V5CVE-2026-115607 CVE-2026-115607 is a critical SQL Injection vulnerability in Crowd Favorite's DXP ToolKit affecting versions from initial releases up to 2.0.1. The flaw allows an attacker to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability is fixed in version 2.0.2. EPSS 0.2%Vulnerability Crowd Favorite	CVE Database V5	2026-10-28
High	7.1	EPSS 0.1%	CVE-2026-115606DXP ToolKit (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.1%2026-10-28CVE Database V5CVE-2026-115606 CVE-2026-115606 is a stored cross-site scripting (XSS) vulnerability in Crowd Favorite's DXP ToolKit affecting versions prior to 2.0.2. The flaw involves improper neutralization of input during web page generation, which can lead to persistent injection of malicious scripts. This vulnerability has a high severity rating with a CVSS score of 7.1. A fix is available in version 2.0.2. EPSS 0.1%Vulnerability Crowd Favorite	CVE Database V5	2026-10-28

Page 1 of 1