Stiofan vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Stiofan products: 8 record(s), with severity, exploitation and fixes.

UsersWP 5 GetPaid 1 Events Calendar for GeoDirectory 1 BlockStrap Page Builder - Bootstrap Blocks 1

Exploited only (KEV) →

CVE-2026-94641 High · 7.1 CWE-79 Oct 9, 2026

WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflected XSS.This issue affects UsersWP: from n/a through 1.2.73.

CVE-2026-94632 High · 7.1 CWE-79 Oct 9, 2026

WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Reflected XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a through 0.1.58.

CVE-2026-103086 Medium · 6.5 CWE-862 Oct 5, 2026

WordPress UsersWP plugin <= 1.2.74 - Broken Access Control vulnerability

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74.

CVE-2026-39532 High · 8.8 CWE-502 Jun 15, 2026

WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.

CVE-2026-49064 High · 7.5 CWE-201 Jun 15, 2026

WordPress GetPaid plugin <= 2.8.49 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve Embedded Sensitive Data. This issue affects GetPaid: from n/a through 2.8.49.

CVE-2026-25015 Medium · 4.3 CWE-352 Feb 3, 2026

WordPress UsersWP plugin <= 1.2.53 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.53.

CVE-2025-67593 Medium · 4.3 CWE-352 Dec 9, 2025

WordPress UsersWP plugin <= 1.2.48 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.48.

CVE-2025-66072 Medium · 5.3 CWE-862 Nov 21, 2025

WordPress UsersWP plugin <= 1.2.47 - Broken Access Control vulnerability

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through <= 1.2.47.