Avalex Vulnerabilities

The avalex – Automatisch sichere Rechtstexte plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.1.3. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 3.1.3

Fixed in:

3.1.4

Disclosed:

Mar 17, 2026

CVE-2026-25462 on NVD →

The avalex – Automatisch sichere Rechtstexte plugin for WordPress is vulnerable to unauthorized modifcation of data due to a missing capability check on the saveApiKey() function hooked via admin_init in all versions up to, and including, 3.0.8. This makes it possible for unauthenticated attackers to modify the API key...

CVSS:

5.3

Affected:

up to 3.0.8

Fixed in:

3.0.9

Disclosed:

Nov 14, 2023

The avalex – Automatisch sichere Rechtstexte plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'avalex_api_key' parameter in versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-le...

CVSS:

4.4

Affected:

up to 3.0.4

Fixed in:

3.0.4

Disclosed:

Feb 2, 2023

CVE-2023-25059 on NVD →