Marketing Fire vulnerabilities and threats

12 threats

Severity	CVSS	Signals	Threat	Source	Published
Critical	9.1		CVE-2026-116852Widget Options (WordPress plugin) · Code Injection Critical9.12026-10-30CVE Database V5CVE-2026-116852 Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. Vulnerability Marketing Fire CWE-94	CVE Database V5	2026-10-30
Medium	6.5	EPSS 0.2%	CVE-2026-32361Editorial Calendar (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2026-03-13CVE Database V5CVE-2026-32361 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marketing Fire Editorial Calendar editorial-calendar allows DOM-Based XSS.This issue affects Editorial Calendar: from n/a through <= 3.9.0. EPSS 0.2%Vulnerability Marketing Fire	CVE Database V5	2026-03-13
Critical	9.0	EPSS 0.3%	CVE-2026-27984Widget Options (WordPress plugin) · Code Injection Critical9.0EPSS 0.3%2026-03-05CVE Database V5CVE-2026-27984 Improper Control of Generation of Code ('Code Injection') vulnerability in Marketing Fire Widget Options widget-options allows Code Injection.This issue affects Widget Options: from n/a through <= 4.1.3. EPSS 0.3%Vulnerability Marketing Fire	CVE Database V5	2026-03-05
Medium	6.5	EPSS 0.2%	CVE-2025-39561LoginWP (WordPress plugin) · Missing Authorization Medium6.5EPSS 0.2%2026-01-05CVE Database V5CVE-2025-39561 Missing Authorization vulnerability in Marketing Fire, LLC LoginWP - Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LoginWP - Pro: from n/a through 4.0.8.5. EPSS 0.2%Vulnerability Marketing Fire CWE-862	CVE Database V5	2026-01-05
High	7.5	EPSS 0.2%	CVE-2025-46255LoginWP (WordPress plugin) · Missing Authorization High7.5EPSS 0.2%2026-01-05CVE Database V5CVE-2025-46255 Missing Authorization vulnerability in Marketing Fire LLC LoginWP - Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LoginWP - Pro: from n/a through 4.0.8.5. EPSS 0.2%Vulnerability Marketing Fire CWE-862	CVE Database V5	2026-01-05
Medium	4.3	EPSS 0.2%	CVE-2025-69023Discussion Board (WordPress plugin) · Missing Authorization Medium4.3EPSS 0.2%2025-12-30CVE Database V5CVE-2025-69023 Missing Authorization vulnerability in Marketing Fire Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Discussion Board: from n/a through <= 2.5.7. EPSS 0.2%Vulnerability Marketing Fire	CVE Database V5	2025-12-30
Medium	5.4	EPSS 0.2%	CVE-2025-68603Editorial Calendar (WordPress plugin) · Missing Authorization Medium5.4EPSS 0.2%2025-12-24CVE Database V5CVE-2025-68603 Missing Authorization vulnerability in Marketing Fire Editorial Calendar editorial-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Editorial Calendar: from n/a through <= 3.8.8. EPSS 0.2%Vulnerability Marketing Fire	CVE Database V5	2025-12-24
Medium	6.4	EPSS 0.2%	CVE-2025-8902Widget Options (WordPress plugin) · Cross-site Scripting Medium6.4EPSS 0.2%2025-09-23CVE Database V5CVE-2025-8902 The Widget Options - Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'do_sidebar' shortcode in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. EPSS 0.2%Vulnerability Marketing Fire CWE-79	CVE Database V5	2025-09-23
Critical	9.9	EPSS 1.1%	CVE-2025-22630Widget Options (WordPress plugin) · Command Injection Critical9.9EPSS 1.1%2025-02-14CVE Database V5CVE-2025-22630 Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Marketing Fire Widget Options widget-options allows OS Command Injection.This issue affects Widget Options: from n/a through <= 4.1.0. EPSS 1.1%Vulnerability Marketing Fire	CVE Database V5	2025-02-14
Medium	4.3	EPSS 0.2%	CVE-2025-22722Widget Options (WordPress plugin) · Missing Authorization Medium4.3EPSS 0.2%2025-01-21CVE Database V5CVE-2025-22722 Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through <= 4.0.8. EPSS 0.2%Vulnerability Marketing Fire	CVE Database V5	2025-01-21
Medium	4.3	EPSS 0.4%	CVE-2024-56219Widget Options (WordPress plugin) · Missing Authorization Medium4.3EPSS 0.4%2024-12-31CVE Database V5CVE-2024-56219 Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through <= 4.0.6.1. EPSS 0.4%Vulnerability Marketing Fire	CVE Database V5	2024-12-31
Medium	6.5	EPSS 0.4%	CVE-2024-35691Widget Options (WordPress plugin) · Information Exposure Medium6.5EPSS 0.4%2024-06-08CVE Database V5CVE-2024-35691 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Marketing Fire, LLC Widget Options - Extended.This issue affects Widget Options - Extended: from n/a through 5.1.0. EPSS 0.4%Vulnerability Marketing Fire CWE-200	CVE Database V5	2024-06-08

Page 1 of 1