Skip to content
OpenAdvisories

Vendor

CreativeMindsSolutions

31 known vulnerabilities.

Products

CM On Demand Search And Replace 5 CM Tooltip Glossary 4 CM Business Directory – Optimise and showcase local business 3 CM Answers 3 CM Custom Reports – Flexible reporting to track what matters most 2 CM E-Mail Blacklist – Simple email filtering for safer registration 2 CM Pop-Up banners 2 CM Map Locations 2 CM Popup Plugin for WordPress 1 CM Registration and Invitation Codes 1 CM FAQ – Simplify support with an intuitive FAQ management tool 1 CM Registration – Tailored tool for seamless login and invitation-based registrations 1 CM Map Locations – Visualize and share your locations in a few clicks 1 CM Ad Changer 1 CM Header and Footer – Add custom scripts and styles to your header and footer with ease 1 CM Search And Replace – Optimize content edits with a powerful search and replace tool 1 CM Pop-Up – Create engaging popups to capture attention and boost interaction 1 CM Video Lessons Manager – Simplify video lessons management for better education 1 CM Business Directory 1 CM Header and Footer 1 CM Download Manager 1 CM Ad Changer – A simple tool to control and optimize your site's banners 1
All Critical High Medium Low Exploited only Public exploit

25 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-8892

    CM Business Directory <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta Fields

    The CM Business Directory – Optimise and showcase local business plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Business Address Meta Fields in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output e…

    CreativeMindsSolutions CM Business Directory – Optimise and showcase local business Web / CMS
  • Medium 4.3
    CVE-2026-9236

    CM Ad Changer <= 2.0.7 - Cross-Site Request Forgery to Campaign Deletion via Campaign Management

    The CM Ad Changer – A simple tool to control and optimize your site's banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the cmac_campai…

    CreativeMindsSolutions CM Ad Changer – A simple tool to control and optimize your site's banners Web / CMS
  • Medium 4.4
    CVE-2026-2432

    CM Custom Reports <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels

    The CM Custom Reports – Flexible reporting to track what matters most plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. …

    CreativeMindsSolutions CM Custom Reports – Flexible reporting to track what matters most Web / CMS
  • Medium 6.1
    CVE-2026-2431

    CM Custom Reports <= 1.2.7 - Reflected Cross-Site Scripting via 'date_from' and 'date_to' Parameters

    The CM Custom Reports plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date_from' and 'date_to' parameters in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possi…

    CreativeMindsSolutions CM Custom Reports – Flexible reporting to track what matters most Web / CMS
  • Medium 5.9
    CVE-2026-25004

    WordPress CM Business Directory plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Business Directory cm-business-directory allows Stored XSS.This issue affects CM Business Directory: from n/a through <= 1.5.3.

    CreativeMindsSolutions CM Business Directory
  • Medium 4.4
    CVE-2026-0691

    CM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' Parameter

    The CM E-Mail Blacklist – Simple email filtering for safer registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'black_email' parameter in all versions up to, and including, 1.6.2. This is due to insufficient input sanitizati…

    CreativeMindsSolutions CM E-Mail Blacklist – Simple email filtering for safer registration Web / CMS
  • Medium 4.3
    CVE-2025-54045

    WordPress CM On Demand Search And Replace plugin <= 1.5.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM On Demand Search And Replace: from n/a …

    CreativeMindsSolutions CM On Demand Search And Replace
  • Medium 4.7
    CVE-2025-11167

    CM Registration – Tailored tool for seamless login and invitation-based registrations <= 2.5.6 - Open Redirect

    The CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.5.6. This is due to insufficient validation on the redirect url supplied via …

    CreativeMindsSolutions CM Registration – Tailored tool for seamless login and invitation-based registrations Web / CMS
  • Medium 6.4
    CVE-2025-10178

    CM Business Directory <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The CM Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cmbd_featured_image' shortcode in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplie…

    CreativeMindsSolutions CM Business Directory – Optimise and showcase local business Web / CMS
  • Medium 5.9
    CVE-2025-54727

    WordPress CM On Demand Search And Replace Plugin <= 1.5.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Stored XSS.This issue affects CM On Demand Search And Replace: …

    CreativeMindsSolutions CM On Demand Search And Replace
  • Medium 4.3
    CVE-2025-54728

    WordPress CM On Demand Search And Replace Plugin <= 1.5.2 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Cross Site Request Forgery.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.2.

    CreativeMindsSolutions CM On Demand Search And Replace
  • Medium 4.3
    CVE-2025-54018

    WordPress CM Pop-Up banners plugin <= 1.8.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in CreativeMindsSolutions CM Pop-Up banners cm-pop-up-banners allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Pop-Up banners: from n/a through <= 1.8.4.

    CreativeMindsSolutions CM Pop-Up banners
  • Medium 4.3
    CVE-2025-46246

    WordPress CM Answers plugin <= 3.3.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Answers cm-answers allows Cross Site Request Forgery.This issue affects CM Answers: from n/a through <= 3.3.3.

    CreativeMindsSolutions CM Answers
  • Medium 4.3
    CVE-2025-46245

    WordPress CM Ad Changer plugin <= 2.0.5 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Ad Changer cm-ad-changer allows Cross Site Request Forgery.This issue affects CM Ad Changer: from n/a through <= 2.0.5.

    CreativeMindsSolutions CM Ad Changer
  • Medium 6.5
    CVE-2025-32210

    WordPress CM Registration and Invitation Codes plugin <= 2.5.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CreativeMindsSolutions CM Registration and Invitation Codes cm-invitation-codes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Registration and Invitation Codes: from n/a th…

    CreativeMindsSolutions CM Registration and Invitation Codes
  • Medium 6.5
    CVE-2025-31091

    WordPress CM Header and Footer plugin <= 1.2.4 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Header and Footer cm-header-footer-script-loader allows Stored XSS.This issue affects CM Header and Footer: from n/a through <= 1.2…

    CreativeMindsSolutions CM Header and Footer
  • Medium 6.1
    CVE-2025-2166

    CM FAQ – Simplify support with an intuitive FAQ management tool <= 1.2.5 - Reflected Cross-Site Scripting

    The CM FAQ – Simplify support with an intuitive FAQ management tool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. Th…

    CreativeMindsSolutions CM FAQ – Simplify support with an intuitive FAQ management tool Web / CMS
  • Medium 4.3
    CVE-2024-54267

    WordPress CM Answers plugin <= 3.2.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CreativeMindsSolutions CM Answers cm-answers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Answers: from n/a through <= 3.2.6.

    CreativeMindsSolutions CM Answers
  • Medium 6.1
    CVE-2024-11202

    Multiple Plugins <= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcode

    Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject …

    CreativeMindsSolutions CM Tooltip Glossary CM Business Directory – Optimise and showcase local business CM E-Mail Blacklist – Simple email filtering for safer registration
  • Medium 6.5
    CVE-2024-48041

    WordPress CM Tooltip Glossary plugin <= 4.3.9 - Stored Cross-Site Scripting vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Tooltip Glossary enhanced-tooltipglossary allows Stored XSS.This issue affects CM Tooltip Glossary: from n/a through <= 4.3.9.

    CreativeMindsSolutions CM Tooltip Glossary
  • Medium 6.5
    CVE-2024-43149

    WordPress CM Tooltip Glossary Plugin <= 4.3.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Tooltip Glossary allows Stored XSS.This issue affects CM Tooltip Glossary: from n/a through 4.3.7.

    CreativeMindsSolutions CM Tooltip Glossary
  • Medium 4.3
    CVE-2024-4086

    CM Tooltip Glossary – Powerful Glossary Plugin <= 4.2.11 - Cross-Site Request Forgery

    The CM Tooltip Glossary – Powerful Glossary Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.11. This is due to missing or incorrect nonce validation when saving settings. This makes it possible…

    CreativeMindsSolutions CM Tooltip Glossary Web / CMS
  • Medium 4.3
    CVE-2023-28749

    WordPress CM On Demand Search And Replace Plugin <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.

    CreativeMindsSolutions CM On Demand Search And Replace
  • Medium 5.9
    CVE-2023-31228

    WordPress CM On Demand Search And Replace Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.

    CreativeMindsSolutions CM On Demand Search And Replace
  • Medium 5.9
    CVE-2023-25992

    WordPress CM Answers Plugin <= 3.1.9 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeMindsSolutions CM Answers plugin <= 3.1.9 versions.

    CreativeMindsSolutions CM Answers