Skip to content
OpenAdvisories

Vendor

cifi

9 known vulnerabilities.

cifi at a glance

Last 12 months
3
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 1 vulnerability March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 1 vulnerability Jun July 2026: 1 vulnerability August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202610
Jun 202610
May 202600
Apr 202600
Mar 202600
Feb 202610
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202510
Feb 202500
Jan 202500
Dec 202400

Products

SEO Plugin by Squirrly SEO 5 Starbox – the Author Box for Humans 3 GEO Plugin by Squirrly SEO 1
All Critical High Medium Low Exploited only Public exploit

9 results · Feed

  • High 7.2
    CVE-2026-1667

    SEO Plugin by Squirrly SEO <= 14.0.0 - Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting via savePost()

    The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and including, 14.0.0 due to a leak of an API token and insufficient input sanitization and output escaping. Th…

    cifi GEO Plugin by Squirrly SEO Web / CMS
  • Medium 4.3
    CVE-2026-7624

    SEO Plugin by Squirrly SEO <= 12.4.16 - Missing Authorization to Authenticated (Contributor+) Privileged Cloud API Operations

    The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.4.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible fo…

    cifi SEO Plugin by Squirrly SEO Web / CMS
  • Medium 4.3
    CVE-2025-14342

    SEO Plugin by Squirrly SEO <= 12.4.14 - Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection

    The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sq_ajax_uninstall function in all versions up to, and including, 12.4.14. This makes it possible for authenticated …

    cifi SEO Plugin by Squirrly SEO Web / CMS
  • Medium 6.5
    CVE-2025-1768

    SEO Plugin by Squirrly SEO <= 12.4.05 - Authenticated (Subscriber+) SQL Injection via search Parameter

    The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to blind SQL Injection via the 'search' parameter in all versions up to, and including, 12.4.05 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on…

    cifi SEO Plugin by Squirrly SEO Web / CMS
  • High 8.8
    CVE-2024-6497 EPSS 11%

    SEO Plugin by Squirrly SEO <= 12.3.19 - Authenticated (Contributor+) SQL Injection via url Parameter

    The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 12.3.19 due to insufficient input sanitization and output escaping. This makes it possible for authe…

    cifi SEO Plugin by Squirrly SEO Web / CMS
  • Medium 6.4
    CVE-2023-6806

    Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Job Settings

    The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Job Settings user profile fields in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authentic…

    cifi Starbox – the Author Box for Humans Web / CMS
  • Medium 6.4
    CVE-2024-0256

    Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Display Name and Social Settings

    The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Profile Display Name and Social Settings in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for a…

    cifi Starbox – the Author Box for Humans Web / CMS
  • Medium 4.3
    CVE-2024-0366

    Starbox – the Author Box for Humans <= 3.4.7 - Insecure Direct Object Reference

    The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.7 via the action function due to missing validation on a user controlled key. This makes it possible for s…

    cifi Starbox – the Author Box for Humans Web / CMS
  • Medium 4.4
    CVE-2024-0597

    SEO Plugin by Squirrly SEO <= 12.3.15 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings

    The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 12.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticate…

    cifi SEO Plugin by Squirrly SEO Web / CMS