Skip to content
OpenAdvisories

Vendor

Alobaidi

6 known vulnerabilities.

Products

PopAd 1 Extend Link 1 Video PopUp 1 Alobaidi Captcha 1 Archive Page 1 The Tooltip 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 4.9
    CVE-2026-25310

    WordPress Extend Link plugin <= 2.0.0 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Alobaidi Extend Link extend-link allows Server Side Request Forgery.This issue affects Extend Link: from n/a through <= 2.0.0.

    Alobaidi Extend Link
  • Medium 6.4
    CVE-2025-13908

    The Tooltip <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

    The The Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'the_tooltip' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This…

    Alobaidi The Tooltip Web / CMS
  • Medium 5.3
    CVE-2025-9616

    PopAd <= 1.0.4 - Cross-Site Request Forgery to Settings Update

    The PopAd plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the PopAd_reset_cookie_time function. This makes it possible for unauthenticated at…

    Alobaidi PopAd Web / CMS
  • Medium 4.4
    CVE-2025-8080

    Alobaidi Captcha <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings

    The Alobaidi Captcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated att…

    Alobaidi Alobaidi Captcha Web / CMS
  • Medium 6.5
    CVE-2025-27280

    WordPress Archive Page plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alobaidi Archive Page archive-page allows DOM-Based XSS.This issue affects Archive Page: from n/a through <= 1.0.2.

    Alobaidi Archive Page
  • Medium 6.4
    CVE-2023-4962

    Video PopUp <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Video PopUp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'video_popup' shortcode in versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl…

    Alobaidi Video PopUp Web / CMS