itthinx
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Groups | 2 | – | Feb 19, 2026 |
| Affiliates | 1 | – | Oct 14, 2026 |
| Groups – Memberships and Access Control | 1 | – | Sep 26, 2026 |
Exploited and recent CVEs
- CVE-2026-108291 WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability 0.4%
- CVE-2026-77203 Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode 0.3%
- CVE-2026-0549 Groups <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode 0.3%
- CVE-2025-11748 Groups <= 3.7.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Group Join 0.2%