mhmrajib Vulnerabilities and Affected Products - Exploit Intel

Skip to content

Products

WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes3 vulnerabilities
AidWP – Donation & Payment Forms (Stripe Powered)2 vulnerabilities
TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More2 vulnerabilities
HM Multiple Roles1 vulnerability
JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin1 vulnerability

mhmrajib vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2024-13362MEDIUM	Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CWE-79May 1, 2026	CVSS6.1v3.1	EPSS0.276%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-5347MEDIUM	WP Books Gallery <= 4.8.0 - Missing Authorization to Unauthenticated Settings Update via 'permalink_structure' Parameter The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0. This is due to the absence of capability checks and nonce verification in the admin_init hook that handles the permalink settings update at line 205-209 of wp-books-gallery.php. The vulnerable code checks only for the presence of the 'permalink_structure' POST parameter before updating the 'wbg_cpt_slug' option, without verifying that the request comes from an authenticated adm… CWE-862Apr 24, 2026	CVSS5.3v3.1	EPSS0.323%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-2010HIGH	JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin <= 2.3.9 - Unauthenticated SQL Injection The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwp_upload_resume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from… CWE-89Apr 19, 20251 related artifact	CVSS7.5v3.1	EPSS1.68%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2022-4974MEDIUM	Freemius SDK <= 2.4.2 - Missing Authorization Checks The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable. CWE-862Oct 16, 2024	CVSS6.3v3.1	EPSS0.442%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX