RD Station <= 5.6.0 - Authenticated (Contributor+) Remote Code Execution
high
The RD Station plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.6.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
- CVSS:
- 8.8
- Affected:
- up to 5.6.0
- Fixed in:
- 5.7.0
- Disclosed:
- Jun 4, 2026
CVE-2026-49774 on NVD →
RD Station [integracao-rd-station] < 5.4.0
unknown
[en] The RD Station plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.3.2 due to insufficient input sanitization and output escaping of post metaboxes added by the plugin. This makes it possible for authenticated attackers, with Contributor-level access and above,...
- Affected:
- up to 5.4.0
- Fixed in:
- 5.4.0
- Disclosed:
- Sep 5, 2024
CVE-2024-6894 on NVD →
RD Station <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The RD Station plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.3.2 due to insufficient input sanitization and output escaping of post metaboxes added by the plugin. This makes it possible for authenticated attackers, with Contributor-level access and above, to i...
- CVSS:
- 6.4
- Affected:
- up to 5.3.2
- Fixed in:
- 5.4.0
- Disclosed:
- Sep 4, 2024
CVE-2024-6894 on NVD →
RD Station <= 5.1.3 - Cross-Site Request Forgery to Plugin Log Deletion
high
The RD Station plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.3. This is due to missing or incorrect nonce validation on the clear_log_file function. This makes it possible for unauthenticated attackers to delete the plugin's logs, via forged request granted they...
- CVSS:
- 8.8
- Affected:
- up to 5.1.3
- Fixed in:
- 5.2.0
- Disclosed:
- Oct 18, 2022
CVE-2022-38139 on NVD →
RD Station [integracao-rd-station] < 5.2.1
unknown
[en] Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in RD Station plugin <= 5.2.0 at WordPress.
- Affected:
- up to 5.2.1
- Fixed in:
- 5.2.1
- Disclosed:
- Sep 13, 2022
CVE-2022-38139 on NVD →
RD Station <= 5.2.0 - Cross-Site Request Forgery to Plugin Settings Update
high
The RD Station plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.2.0. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to invoke those functions (including one resulting in settings update),...
- CVSS:
- 8.8
- Affected:
- up to 5.2.0
- Fixed in:
- 5.2.1
- Disclosed:
- Sep 11, 2022
CVE-2022-38139 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database