Log in Start free

10up

Products

ProductCVEsExploitedLatest
Simple Local Avatars3–Aug 12, 2025
ElasticPress3–Sep 11, 2026
Distributor3–Oct 16, 2026
Safe SVG2–Sep 30, 2026
Eight Day Week Print Workflow2–May 12, 2026
Restricted Site Access2–Oct 14, 2026
Simple Page Ordering1–Dec 13, 2024
Microsoft Azure Storage for WordPress1–Oct 24, 2025
Autoshare for Twitter1–Feb 19, 2026

Exploited and recent CVEs

  • CVE-2026-111631 Medium 5.4 Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions 0.2%
  • CVE-2026-111628 Medium 5.0 10up Distributor before 2.3.2 PHP Object Injection via set_meta() 0.3%
  • CVE-2026-111625 Medium 5.0 10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action 0.2%
  • CVE-2026-110227 Medium 5.3 WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability 0.2%
  • CVE-2026-94672 Medium 4.3 WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability 0.2%
  • CVE-2026-94077 Medium 6.5 WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-62088 Medium 5.3 WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability 0.3%
  • CVE-2026-5028 Medium 6.5 Eight Day Week Print Workflow <= 1.2.6 - Authenticated (Subscriber+) SQL Injection via 'title' Parameter 0.2%
  • CVE-2026-25311 Medium 5.4 WordPress Autoshare for Twitter plugin <= 2.3.1 - Broken Access Control vulnerability 0.2%
  • CVE-2025-67621 Medium 4.3 WordPress Eight Day Week Print Workflow plugin <= 1.2.5 - Sensitive Data Exposure vulnerability 0.3%
  • CVE-2025-10749 Medium 5.4 Microsoft Azure Storage for WordPress <= 4.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion 0.3%
  • CVE-2025-8482 Medium 4.3 Simple Local Avatars <= 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Avatar Migration 0.3%
  • CVE-2023-32798 Medium 5.3 WordPress Simple Page Ordering plugin <= 2.5.0 - Broken Access Control vulnerability 0.6%
  • CVE-2024-10786 Medium 4.3 Simple Local Avatars <= 2.7.11 - Missing Authorization to Authenticated (Subscriber+) User Cache Clearing 0.3%
  • CVE-2024-43116 Medium 4.3 WordPress Simple Local Avatars plugin <= 2.7.10 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
  • CVE-2024-35684 Medium 4.3 WordPress ElasticPress plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
  • CVE-2023-48753 Medium 5.3 WordPress Restricted Site Access plugin <= 7.4.1 - IP Restriction Bypass vulnerability 0.4%
  • CVE-2021-4405 Medium 4.3 ElasticPress <= 3.5.3 - Cross-Site Request Forgery Bypass 0.4%