rafasashi

Products

Product	CVEs	Exploited	Latest
User Session Synchronizer	2	–	Aug 15, 2026
Custom New User Notification	1	–	Apr 16, 2026
Language Switcher	1	–	Oct 11, 2024
SVG Captcha	1	–	Oct 29, 2024
Todo Custom Field	1	–	Oct 29, 2024

CVE-2026-15341 Critical 9.8 User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters 0.6%
CVE-2026-3551 Medium 4.4 Custom New User Notification <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'User Mail Subject' Setting 0.4%
CVE-2025-32612 High 7.1 WordPress User Session Synchronizer plugin <= 1.4.0 - CSRF to Stored XSS vulnerability 0.2%
CVE-2024-49648 High 7.1 WordPress SVG Captcha plugin <= 1.0.11 - Reflected Cross Site Scripting (XSS) vulnerability 0.3%
CVE-2024-49642 High 7.1 WordPress Todo Custom Field plugin <= 3.0.4 - Reflected Cross Site Scripting (XSS) vulnerability 0.3%
CVE-2024-9610 Medium 6.1 Language Switcher <= 3.7.13 - Reflected Cross-Site Scripting 0.4%