Log in Start free

XWP

Products

ProductCVEsExploitedLatest
Stream4–Feb 17, 2025
Stream – Activity Log & Audit Trail1–Aug 7, 2026

Exploited and recent CVEs

  • CVE-2026-11907 Medium 6.5 Stream <= 4.2.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat API 0.4%
  • CVE-2024-13879 Medium 5.5 Stream <= 4.0.2 - Authenticated (Admin+) Server-Side Request Forgery 0.3%
  • CVE-2024-7423 High 8.8 Stream <= 4.0.1 - Cross-Site Request Forgery to Arbitrary Options Update 0.3%
  • CVE-2022-43450 Medium 4.3 WordPress Stream Plugin <= 3.9.2 is vulnerable to Insecure Direct Object References (IDOR) 0.7%
  • CVE-2022-43490 Medium 5.4 WordPress Stream Plugin <= 3.9.2 is vulnerable to Cross Site Request Forgery (CSRF) 0.3%