Adminimize Vulnerabilities

The Adminimize plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.11.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.11.11

Fixed in:

1.11.12

Disclosed:

May 27, 2026

CVE-2026-49045 on NVD →

Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.

CVSS:

6.1

Affected:

up to 1.7.21

Fixed in:

1.7.22

Disclosed:

Aug 1, 2014

CVE-2011-4926 on NVD →

Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize plugin before 1.7.22 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) inc-options/deinstall_options.php, (2) inc-options/theme_options.php, or (3) inc-options/im_export_options.php, or the (4)...

CVSS:

5.3

Affected:

up to 1.7.22

Fixed in:

1.7.22

Disclosed:

Aug 1, 2014

CVE-2011-5128 on NVD →

[en] Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize plugin before 1.7.22 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) inc-options/deinstall_options.php, (2) inc-options/theme_options.php, or (3) inc-options/im_export_options.php, or the...

Affected:

up to 1.7.22

Fixed in:

1.7.22

Disclosed:

Aug 29, 2012

CVE-2011-5128 on NVD →

[en] Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.

Affected:

up to 1.7.22

Fixed in:

1.7.22

Disclosed:

Aug 29, 2012

CVE-2011-4926 on NVD →