Progress Planner Vulnerabilities

The Progress Planner plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary web scripts in pages that...

CVSS:

4.4

Affected:

up to 1.9.0

Fixed in:

1.9.1

Disclosed:

Jun 2, 2026

CVE-2026-28116 on NVD →

The Progress Planner plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the handle_interactive_task_submit() function in all versions up to, and including, 1.8.0. This makes it possible for authenticated attackers, with Subs...

CVSS:

8.8

Affected:

up to 1.8.0

Fixed in:

1.8.1

Disclosed:

Oct 6, 2025

CVE-2025-48082 on NVD →

The Progress Planner plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 0.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages...

CVSS:

6.4

Affected:

up to 0.9.2

Fixed in:

0.9.3

Disclosed:

Jun 27, 2024

CVE-2024-37422 on NVD →

The Progress Planner plugin for WordPress is vulnerable to unauthorized access of data due to an insufficient capability check in the validate_token() function in versions up to, and including, 0.9.1. This makes it possible for unauthenticated attackers to retrieve stats.

CVSS:

5.3

Affected:

up to 0.9.1

Fixed in:

0.9.2

Disclosed:

Jun 27, 2024

CVE-2024-37411 on NVD →