PickPlugins Vulnerabilities and Affected Products
Vulnerabilities associated with Question Answer.
Products
Clear product- Post Grid12 vulnerabilities
- Job Board Manager9 vulnerabilities
- Post Grid and Gutenberg Blocks8 vulnerabilities
- Wishlist6 vulnerabilities
- Accordion5 vulnerabilities
- post_grid4 vulnerabilities
- post_grid_combo4 vulnerabilities
- Product Slider for WooCommerce3 vulnerabilities
- Question Answer3 vulnerabilities
- Team Showcase3 vulnerabilities
- Testimonial Slider3 vulnerabilities
- Accordions2 vulnerabilities
- Mail Picker2 vulnerabilities
- PickPlugins Product Designer for WooCommerce2 vulnerabilities
- Product Designer2 vulnerabilities
- product_designer2 vulnerabilities
- User Verification by PickPlugins2 vulnerabilities
- ComboBlocks1 vulnerability
- page_builder_comboblocks1 vulnerability
- PickPlugins Pricing Table1 vulnerability
- PickPlugins Product Slider for WooCommerce1 vulnerability
- PickPlugins Question Answer1 vulnerability
- Post Grid and Gutenberg Blocks – ComboBlocks1 vulnerability
- Post Grid Combo – 36+ Gutenberg Blocks1 vulnerability
- product_slider_for_woocommerce1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-32646HIGH | WordPress Question Answer plugin <= 1.2.70 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Question Answer question-answer allows Reflected XSS.This issue affects Question Answer: from n/a through <= 1.2.70. CWE-79Apr 17, 2025 | CVSS7.1v3.1 | EPSS0.276% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-32647HIGH | WordPress Question Answer plugin <= 1.2.73 - PHP Object Injection vulnerabilityDeserialization of Untrusted Data vulnerability in PickPlugins Question Answer question-answer allows Object Injection.This issue affects Question Answer: from n/a through <= 1.2.73. CWE-502Apr 17, 2025 | CVSS8.8v3.1 | EPSS0.45% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-31810MEDIUM | WordPress Question Answer plugin <= 1.2.73 - Broken Access Control vulnerabilityMissing Authorization vulnerability in PickPlugins Question Answer question-answer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Question Answer: from n/a through <= 1.2.73. CWE-862Apr 1, 2025 | CVSS5.3v3.1 | EPSS0.421% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |