Pagup
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) | 2 | – | May 1, 2026 |
| Automatic Internal Links for SEO by Pagup | 2 | – | May 1, 2026 |
| WP Google Street View (with 360° virtual tour) & Google maps + Local SEO | 2 | – | Jan 9, 2026 |
| WP Google Street View | 1 | – | Mar 27, 2025 |
| Bulk Auto Image Title Attribute | 1 | – | Oct 27, 2025 |
| Ads.txt & App-ads.txt Manager for WordPress | 1 | – | Oct 29, 2024 |
| WordPress Robots.txt optimization | 1 | – | Jul 11, 2023 |
Exploited and recent CVEs
- CVE-2024-13362 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter 0.3%
- CVE-2024-13362 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter 0.3%
- CVE-2026-0563 WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' Shortcode 0.2%
- CVE-2025-15019 BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
- CVE-2025-62921 WordPress Bulk Auto Image Title Attribute plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability 0.2%
- CVE-2025-30799 WordPress WP Google Street View plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerability 0.4%
- CVE-2024-13542 WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
- CVE-2024-11009 Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) <= 1.2.1 - Authenticated (Administrator+) SQL Injection via post_id Parameter 0.4%
- CVE-2024-50415 WordPress Ads.txt & App-ads.txt Manager for WordPress plugin <= 1.1.7.1 - Stored Cross Site Scripting (XSS) vulnerability 0.3%
- CVE-2023-25706 WordPress Robots.txt optimization plugin <= 1.4.5 is vulnerable to Cross Site Request Forgery (CSRF) 0.2%