Mesmerize Companion Vulnerabilities

[en] The Mesmerize Companion plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the "openPageInCustomizer" and "openPageInDefaultEditor" functions in all versions up to, and including, 1.6.158. This makes it possible for authenticated attackers - with...

Affected:

up to 1.6.162

Fixed in:

1.6.162

Disclosed:

Feb 19, 2026

CVE-2025-12027 on NVD →

The Mesmerize Companion plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the "openPageInCustomizer" and "openPageInDefaultEditor" functions in all versions up to, and including, 1.6.158. This makes it possible for authenticated attackers - with subs...

CVSS:

4.3

Affected:

up to 1.6.158

Fixed in:

1.6.162

Disclosed:

Feb 18, 2026

CVE-2025-12027 on NVD →

[en] The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerize_contact_form' shortcode in all versions up to, and including, 1.6.148 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

Affected:

up to 1.6.149

Fixed in:

1.6.149

Disclosed:

May 8, 2024

CVE-2024-3494 on NVD →

The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerize_contact_form' shortcode in all versions up to, and including, 1.6.148 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated att...

CVSS:

6.4

Affected:

up to 1.6.148

Fixed in:

1.6.149

Disclosed:

May 7, 2024

CVE-2024-3494 on NVD →

[en] The Mesmerize Companion WordPress plugin before 1.6.135 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users su...

Affected:

up to 1.6.135

Fixed in:

1.6.135

Disclosed:

Jan 16, 2023

CVE-2022-4481 on NVD →

The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode in versions up to, and including, 1.6.133 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitr...

CVSS:

6.4

Affected:

up to 1.6.133

Fixed in:

1.6.135

Disclosed:

Dec 20, 2022

CVE-2022-4481 on NVD →