Denishua vulnerabilities
Published CVEs affecting Denishua products: 4 record(s), with severity, exploitation and fixes.
CVE-2026-57372
High · 7.2
CWE-918 Jul 13, 2026
WordPress WPJAM Basic plugin <= 7.0 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery (SSRF) vulnerability in denishua WPJAM Basic wpjam-basic allows Server Side Request Forgery.This issue affects WPJAM Basic: from n/a through <= 7.0.
CVE-2026-57371
High · 8.8
CWE-502 Jul 13, 2026
WordPress WPJAM Basic plugin <= 7.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object Injection.This issue affects WPJAM Basic: from n/a through <= 7.0.
CVE-2026-32523
Critical · 9.9
CWE-434 Mar 25, 2026
WPJAM Basic WordPress plugin unrestricted file upload (CVE-2026-32523)
Unrestricted Upload of File with Dangerous Type vulnerability in denishua WPJAM Basic wpjam-basic allows Using Malicious Files.This issue affects WPJAM Basic: from n/a through <= 6.9.2.
CVE-2025-12827
Medium · 4.3
CWE-352 Nov 18, 2025
Top Friends <= 0.3 - Cross-Site Request Forgery to Settings Update
The Top Friends plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3. This is due to missing nonce validation on the top_friends_options_subpanel() function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.