Log in Start free

specialk

Products

ProductCVEsExploitedLatest
User Submitted Posts – Enable Users to Submit Posts from the Front End7–Oct 31, 2026
Simple Download Counter4–Mar 26, 2026
Simple Ajax Chat – Add a Fast, Secure Chat Box3–Sep 11, 2026
Head Meta Data1–Jan 20, 2026
Banhammer – Monitor Site Traffic, Block Bad Users and Bots1–Sep 26, 2025
Theme Switcha – Easily Switch Themes for Development and Testing1–Oct 20, 2023
Prismatic1–Apr 16, 2026
Blackhole for Bad Bots1–Mar 26, 2026
Dashboard Widgets Suite1–Jun 13, 2024

Exploited and recent CVEs

  • CVE-2026-119162 High 7.2 User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting 0.2%
  • CVE-2026-81825 High 7.2 Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting 0.5%
  • CVE-2026-3876 High 7.2 Prismatic <= 3.7.3 - Unauthenticated Stored Cross-Site Scripting via 'prismatic_encoded' Pseudo-Shortcode 0.3%
  • CVE-2026-4278 Medium 6.4 Simple Download Counter <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute 0.2%
  • CVE-2026-4329 High 7.2 Blackhole for Bad Bots <= 3.8 - Unauthenticated Stored Cross-Site Scripting via User-Agent HTTP Header 0.3%
  • CVE-2026-2987 Medium 6.1 Simple Ajax Chat <= 20260217 - Unauthenticated Stored Cross-Site Scripting via 'c' 0.2%
  • CVE-2026-2126 Medium 5.3 User Submitted Posts <= 20260113 - Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter 0.4%
  • CVE-2026-0800 High 7.2 User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field 0.2%
  • CVE-2026-0608 Medium 6.4 Head Meta Data <= 20251118 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta 0.2%
  • CVE-2026-0913 Medium 6.4 User Submitted Posts <= 20260110 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcode 0.3%
  • CVE-2025-13677 Medium 4.9 Simple Download Counter <= 2.2.2 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal 0.5%
  • CVE-2025-10745 Medium 5.3 Banhammer – Monitor Site Traffic, Block Bad Users and Bots <= 3.4.8 - Unauthenticated Protection Mechanism Bypass 0.4%
  • CVE-2025-2874 Medium 4.4 User Submitted Posts <= 20241026 - Authenticated (Admin+) Stored Cross-Site Scripting 0.2%
  • CVE-2025-1730 Medium 6.5 Simple Download Counter <= 2.0 - Authenticated (Author+) Arbitrary File Read 0.4%
  • CVE-2024-0979 Medium 6.1 Dashboard Widgets Suite <= 3.4.3 - Reflected Cross-Site Scripting 0.4%
  • CVE-2024-2956 Medium 4.4 Simple Ajax Chat <= 20231101 - Authenticated (Admin+) Stored Cross-Site Scripting 0.3%
  • CVE-2023-5614 Medium 6.4 Theme Switcha <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.5%
  • CVE-2023-4838 Medium 6.4 The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.6 due to insufficient input sanitization a 0.4%
  • CVE-2023-4779 Medium 6.4 User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20230811 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.4%
  • CVE-2023-4308 High 7.2 User Submitted Posts <= 20230809 - Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content' 0.4%