Suretriggers Vulnerabilities

The OttoKit: All-in-One Automation Platform plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.1.35. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and mod...

CVSS:

7.2

Affected:

up to 1.1.35

Fixed in:

1.1.36

Disclosed:

Aug 14, 2026

CVE-2026-32553 on NVD →

The OttoKit: All-in-One Automation Platform plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.1.27 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. I...

CVSS:

8.1

Affected:

up to 1.1.27

Fixed in:

1.1.28

Disclosed:

Jun 4, 2026

CVE-2026-49781 on NVD →

The OttoKit: All-in-One Automation Platform plugin for WordPress is vulnerable to SQL Injection in versions up to 1.1.23 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL...

CVSS:

7.5

Affected:

up to 1.1.23

Fixed in:

1.1.23

Disclosed:

May 11, 2026

CVE-2026-4935 on NVD →

The OttoKit plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.1.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above...

CVSS:

4.9

Affected:

up to 1.1.20

Fixed in:

1.1.21

Disclosed:

Mar 23, 2026

CVE-2026-39479 on NVD →

The OttoKit: All-in-One Automation Platform (Formerly SureTriggers) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.82. This is due to the create_wp_connection() function missing a capability check and insufficiently verifying a user's authentication credentials. Thi...

CVSS:

9.8

Affected:

up to 1.0.82

Fixed in:

1.0.83

Disclosed:

Apr 30, 2025

CVE-2025-27007 on NVD →

The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible...

CVSS:

8.1

Affected:

up to 1.0.78

Fixed in:

1.0.79

Disclosed:

Apr 9, 2025

CVE-2025-3102 on NVD →

The SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Trigger Link shortcode in all versions up to, and including, 1.0.47 due to insufficient input sanitization and output escaping on user supplied attributes. T...

CVSS:

6.4

Affected:

up to 1.0.47

Fixed in:

1.0.48

Disclosed:

Jun 3, 2024

CVE-2024-5485 on NVD →

The SureTriggers plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.23. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted the...

CVSS:

4.3

Affected:

up to 1.0.23

Fixed in:

1.0.24

Disclosed:

Dec 4, 2023

CVE-2023-49749 on NVD →