Secupress Vulnerabilities

The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'secupress_reinstall_plugins_admin_ajax_cb' function in all versions up to, and including, 2.3.9. This makes it possible for authenticated attackers, with Subscriber-l...

CVSS:

4.3

Affected:

up to 2.3.9

Fixed in:

2.3.10

Disclosed:

Apr 28, 2025

CVE-2025-3452 on NVD →

The SecuPress Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages...

CVSS:

6.4

Affected:

up to 2.2.5.3

Fixed in:

2.2.5.4

Disclosed:

Mar 27, 2025

CVE-2025-30907 on NVD →

The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.2.5.3. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 2.2.5.3

Fixed in:

2.3

Disclosed:

Mar 11, 2025

CVE-2024-43228 on NVD →

The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's secupress_check_ban_ips_form shortcode in all versions up to, and including, 2.2.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVSS:

6.4

Affected:

up to 2.2.5.3

Fixed in:

2.3

Disclosed:

Feb 27, 2025

CVE-2024-9019 on NVD →

The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5.1. This is due to missing or incorrect nonce validation on the secupress_blackhole_ban_ip() function. This makes it possible for unauthenticated attackers to block a user'...

CVSS:

4.3

Affected:

up to 2.2.5.1

Fixed in:

2.2.5.2

Disclosed:

Apr 1, 2024

CVE-2024-1504 on NVD →

The SecuPress Free and SecuPress Pro plugins for WordPress is vulnerable to unauthenticated arbitrary IP bans in versions up to, and including, 1.4.12. This makes it possible for unauthenticated remote attackers to ban any IP address from accessing the site.

CVSS:

7.5

Affected:

up to 2.0

Fixed in:

2.0

Disclosed:

Mar 22, 2021