plugin

Integration Cds Vulnerabilities

2 known security issues reported for the Integration Cds WordPress plugin. Most recent disclosed Jun 2, 2026.

1 high 1 medium

Running Integration Cds on your site? Check whether your installed version is affected.

Scan your site free

Dataverse Integration <= 2.90 - Authenticated (Contributor+) Server-Side Template Injection to Information Exposure

medium

The DataPress (Dataverse Integration) plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and including, 2.90. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive information.

CVSS:
4.3
(Wordfence)
Affected:
up to 2.90
Fixed in:
2.91
Disclosed:
Jun 2, 2026

CVE-2026-5336 on NVD →

Dataverse Integration 2.77 - 2.81 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset_password_link REST Route

high

The Dataverse Integration plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within its reset_password_link REST endpoint in versions 2.77 through 2.81. The endpoint’s handler accepts a client-supplied id, email, or login, looks up that user, and calls get_password_reset_key(...

CVSS:
8.8
(Wordfence)
Affected:
2.77 – 2.81
Fixed in:
2.81.1
Disclosed:
Jul 23, 2025

CVE-2025-7695 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database