Jeff Starr Vulnerabilities and Affected Products

Open in search

Explore source-attributed vulnerabilities associated with Jeff Starr products.

Products

Showing 17 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

WordPress Simple Ajax Chat plugin <= 20251121 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Jeff Starr Simple Ajax Chat simple-ajax-chat allows Retrieve Embedded Sensitive Data.This issue affects Simple Ajax Chat: from n/a through <= 20251121.

CWE-497Feb 23, 2026
CVSS5.3v3.1EPSS0.304%PoCs0SignalsSTIX

WordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Jeff Starr User Submitted Posts user-submitted-posts allows Phishing.This issue affects User Submitted Posts: from n/a through <= 20251121.

CWE-601Dec 24, 20251 related artifact
CVSS4.7v3.1EPSS0.486%PoCs0SignalsSTIX

WordPress Head Meta Data plugin <= 20250327 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Head Meta Data head-meta-data allows Stored XSS.This issue affects Head Meta Data: from n/a through <= 20250327.

CWE-79Nov 21, 2025
CVSS5.9v3.1EPSS0.199%PoCs0SignalsSTIX

WordPress Simple Statistics for Feeds Plugin <= 20250322 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Jeff Starr Simple Statistics for Feeds simple-feed-stats allows Cross Site Request Forgery.This issue affects Simple Statistics for Feeds: from n/a through <= 20250322.

CWE-352Aug 22, 2025
CVSS4.3v3.1EPSS0.128%PoCs0SignalsSTIX

WordPress Simple Blog Stats plugin <= 20250416 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Simple Blog Stats simple-blog-stats allows Stored XSS.This issue affects Simple Blog Stats: from n/a through <= 20250416.

CWE-79May 7, 2025
CVSS6.5v3.1EPSS0.245%PoCs0SignalsSTIX

WordPress Simple Download Counter plugin <= 2.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Simple Download Counter simple-download-counter allows Stored XSS.This issue affects Simple Download Counter: from n/a through <= 2.2.

CWE-79Apr 22, 2025
CVSS6.5v3.1EPSS0.209%PoCs0SignalsSTIX

WordPress Theme Switcha plugin <= 3.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Theme Switcha theme-switcha allows Stored XSS.This issue affects Theme Switcha: from n/a through <= 3.4.

CWE-79Apr 22, 2025
CVSS6.5v3.1EPSS0.209%PoCs0SignalsSTIX

WordPress User Submitted Posts plugin <= 20230901 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS.This issue affects User Submitted Posts: from n/a through 20230901.

CWE-79Mar 26, 2024
CVSS6.5v3.1EPSS0.339%PoCs0SignalsSTIX

WordPress User Submitted Posts Plugin <= 20230902 is vulnerable to Arbitrary File Upload

Unrestricted Upload of File with Dangerous Type vulnerability in Jeff Starr User Submitted Posts – Enable Users to Submit Posts from the Front End.This issue affects User Submitted Posts – Enable Users to Submit Posts from the Front End: from n/a through 20230902.

CWE-434Dec 20, 2023
CVSS9.0v3.1EPSS0.903%PoCs0SignalsSTIX

WordPress Dashboard Widgets Suite Plugin <= 3.4.1 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Dashboard Widgets Suite allows Stored XSS.This issue affects Dashboard Widgets Suite: from n/a through 3.4.1.

CWE-79Dec 14, 2023
CVSS5.9v3.1EPSS0.394%PoCs0SignalsSTIX

WordPress Dashboard Widgets Suite Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeff Starr Dashboard Widgets Suite plugin <= 3.2.1 versions.

CWE-79May 6, 2023
CVSS5.9v3.1EPSS0.369%PoCs0SignalsSTIX

WordPress Simple Ajax Chat plugin <= 20220115 - Multiple Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) in Simple Ajax Chat (WordPress plugin) <= 20220115 allows an attacker to clear the chat log or delete a chat message.

CWE-352Apr 15, 2022
CVSS5.4v3.1EPSS0.381%PoCs0SignalsSTIX

WordPress Simple Ajax Chat plugin <= 20220115 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115

CWE-200Apr 15, 20221 related artifact
CVSS5.3v3.1EPSS4.62%PoCs0SignalsSTIX

WordPress Simple Ajax Chat plugin <= 20220115 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code. However, the attack requires specific conditions, making it hard to exploit.

CWE-79Mar 25, 2022
CVSS3.4v3.1EPSS0.709%PoCs0SignalsSTIX

WordPress Contact Form X plugin <= 2.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4).

CWE-79Mar 11, 2022
CVSS4.7v3.1EPSS1.02%PoCs0SignalsSTIX

Prismatic < 2.8 - Reflected Cross-Site Scripting (XSS)

The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator

CWE-79Jul 12, 20211 related artifact
CVSS6.1v3.1EPSS1.79%PoCs0SignalsSTIX

Prismatic < 2.8 - Contributor+ Stored XSS

The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters, allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS trigger able in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.

CWE-79Jul 12, 2021
CVSS5.4v3.1EPSS0.624%PoCs0SignalsSTIX