Threat database

33 threats

Severity	CVSS	Signals	Threat	Source	Published
High	8.1	EPSS 0.5%	CVE-2026-28150Golo Framework (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.5%2026-08-20CVE Database V5CVE-2026-28150 CVE-2026-28150 is a high-severity vulnerability in the uxper Golo Framework versions prior to 1.7.5. It involves an unauthenticated Local File Inclusion (LFI) flaw, classified under CWE-98, which relates to improper control of filenames in include/require statements in PHP programs. This vulnerability allows an attacker to include local files on the server without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. EPSS 0.5%Vulnerability uxper #cwe-98 #ghsa-hgrh-qm6w-jjgv	CVE Database V5	2026-08-20
Medium	5.3	EPSS 0.3%	CVE-2026-65525Civi Framework (WordPress plugin) · Missing Authorization Medium5.3EPSS 0.3%2026-07-23CVE Database V5CVE-2026-65525 Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions. EPSS 0.3%Vulnerability uxper #cwe-862	CVE Database V5	2026-07-23
Medium	5.3	EPSS 0.3%	CVE-2026-65476Civi (WordPress plugin) · Missing Authorization Medium5.3EPSS 0.3%2026-07-23CVE Database V5CVE-2026-65476 Unauthenticated Broken Access Control in Civi <= 2.2.4 versions. EPSS 0.3%Vulnerability uxper #cwe-862	CVE Database V5	2026-07-23
High	7.5	EPSS 0.5%	CVE-2026-57799Nuss (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High7.5EPSS 0.5%2026-07-13CVE Database V5CVE-2026-57799 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Nuss nuss allows PHP Local File Inclusion.This issue affects Nuss: from n/a through <= 1.3.6. EPSS 0.5%Vulnerability uxper #cwe-98	CVE Database V5	2026-07-13
High	7.5	EPSS 0.5%	CVE-2026-57794Golo Framework (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High7.5EPSS 0.5%2026-07-13CVE Database V5CVE-2026-57794 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo Framework golo-framework allows PHP Local File Inclusion.This issue affects Golo Framework: from n/a through <= 1.7.3. EPSS 0.5%Vulnerability uxper #cwe-98	CVE Database V5	2026-07-13
Critical	9.8	EPSS 0.3%	CVE-2026-27051Golo (WordPress plugin) · Incorrect Privilege Assignment Critical9.8EPSS 0.3%2026-03-25CVE Database V5CVE-2026-27051 Incorrect Privilege Assignment vulnerability in uxper Golo golo allows Privilege Escalation.This issue affects Golo: from n/a through <= 1.7.0. EPSS 0.3%Vulnerability uxper	CVE Database V5	2026-03-25
High	7.1	EPSS 0.2%	CVE-2026-23973Golo (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-03-25CVE Database V5CVE-2026-23973 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Golo golo allows Reflected XSS.This issue affects Golo: from n/a through < 1.7.5. EPSS 0.2%Vulnerability uxper	CVE Database V5	2026-03-25
High	7.5	EPSS 0.5%	CVE-2026-23975Golo (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High7.5EPSS 0.5%2026-01-22CVE Database V5CVE-2026-23975 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo golo allows PHP Local File Inclusion.This issue affects Golo: from n/a through < 1.7.5. EPSS 0.5%Vulnerability uxper	CVE Database V5	2026-01-22
Medium	5.3	EPSS 0.2%	CVE-2026-23974Golo (WordPress plugin) · Missing Authorization Medium5.3EPSS 0.2%2026-01-22CVE Database V5CVE-2026-23974 Missing Authorization vulnerability in uxper Golo golo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Golo: from n/a through < 1.7.5. EPSS 0.2%Vulnerability uxper	CVE Database V5	2026-01-22
High	7.1	EPSS 0.2%	CVE-2025-52739Sala (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2025-12-31CVE Database V5CVE-2025-52739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Sala allows Reflected XSS.This issue affects Sala: from n/a through 1.1.3. EPSS 0.2%Vulnerability uxper #cwe-79	CVE Database V5	2025-12-31
Medium	6.5	EPSS 0.3%	CVE-2025-62037Togo (WordPress plugin) · Missing Authorization Medium6.5EPSS 0.3%2025-11-06CVE Database V5CVE-2025-62037 Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4. EPSS 0.3%Vulnerability uxper	CVE Database V5	2025-11-06
High	7.1	EPSS 0.2%	CVE-2025-62036Togo (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2025-11-06CVE Database V5CVE-2025-62036 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4. EPSS 0.2%Vulnerability uxper	CVE Database V5	2025-11-06
High	8.8	EPSS 0.4%	CVE-2025-62035Togo (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.4%2025-11-06CVE Database V5CVE-2025-62035 Deserialization of Untrusted Data vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4. EPSS 0.4%Vulnerability uxper	CVE Database V5	2025-11-06
High	8.8	EPSS 0.4%	CVE-2025-62034Togo (WordPress plugin) · Incorrect Privilege Assignment High8.8EPSS 0.4%2025-11-06CVE Database V5CVE-2025-62034 Incorrect Privilege Assignment vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4. EPSS 0.4%Vulnerability uxper	CVE Database V5	2025-11-06
Medium	6.5	EPSS 0.3%	CVE-2025-62033Togo (WordPress plugin) · Missing Authorization Medium6.5EPSS 0.3%2025-11-06CVE Database V5CVE-2025-62033 Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4. EPSS 0.3%Vulnerability uxper	CVE Database V5	2025-11-06
High	8.1	EPSS 0.6%	CVE-2025-54709Sala (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.6%2025-09-09CVE Database V5CVE-2025-54709 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Sala. This issue affects Sala: from n/a through 1.1.6. EPSS 0.6%Vulnerability uxper #cwe-98	CVE Database V5	2025-09-09
Critical	9.8	EPSS 0.4%	CVE-2025-54725Golo (WordPress plugin) · Authentication Bypass Using an Alternate Path or Channel Critical9.8EPSS 0.4%2025-08-28CVE Database V5CVE-2025-54725 Authentication Bypass Using an Alternate Path or Channel vulnerability in uxper Golo golo allows Authentication Abuse.This issue affects Golo: from n/a through <= 1.7.0. EPSS 0.4%Vulnerability uxper #cwe-288	CVE Database V5	2025-08-28
High	7.1	EPSS 0.2%	CVE-2025-54724Golo (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2025-08-28CVE Database V5CVE-2025-54724 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Golo golo allows Reflected XSS.This issue affects Golo: from n/a through <= 1.7.1. EPSS 0.2%Vulnerability uxper #cwe-79	CVE Database V5	2025-08-28
High	8.5	EPSS 0.3%	CVE-2025-49891Uxper Booking (WordPress plugin) · SQL Injection High8.5EPSS 0.3%2025-08-20CVE Database V5CVE-2025-49891 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in uxper Uxper Booking uxper-booking allows Blind SQL Injection.This issue affects Uxper Booking: from n/a through <= 1.3.3. EPSS 0.3%Vulnerability uxper	CVE Database V5	2025-08-20
High	8.1	EPSS 0.8%	CVE-2025-49892Uxper Booking (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.8%2025-08-20CVE Database V5CVE-2025-49892 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Uxper Booking uxper-booking allows PHP Local File Inclusion.This issue affects Uxper Booking: from n/a through <= 1.3.3. EPSS 0.8%Vulnerability uxper	CVE Database V5	2025-08-20

Page 1 of 2