Ravpage Vulnerabilities

The Ravpage plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.40 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a...

CVSS:

6.1

Affected:

up to 2.40

Fixed in:

2.41

Disclosed:

Jan 20, 2026

CVE-2025-68835 on NVD →

The ravpage plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.31 via deserialization of untrusted input from the 'paramsv2' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, w...

CVSS:

9.8

Affected:

up to 2.31

Fixed in:

2.33

Disclosed:

Feb 19, 2025

CVE-2024-13789 on NVD →

Rav Messer's Ravpage <= 2.16 is vulnerable to Cross-Site Scripting exploitable by unauthenticated attackers. Versions up to 2.16 are affected.

CVSS:

6.1

Affected:

up to 2.16

Fixed in:

2.18

Disclosed:

Apr 28, 2022

CVE-2022-29415 on NVD →