Skip to content
OpenAdvisories

Vendor

David Anderson

30 known vulnerabilities.

Products

Redux Framework 16 UpdraftPlus: WP Backup & Migration Plugin 4 WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance 2 All-In-One Security (AIOS) – Security and Firewall 2 Testimonial Slider (WordPress plugin) 1 Easy Updates Manager 1 Testimonial Slider 1 European VAT Compliance Assistant for WooCommerce 1 Internal Link Juicer: SEO Auto Linker for WordPress 1 WPGet API – Connect to any external REST API 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.2
    CVE-2026-100316

    European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header

    The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This make…

    David Anderson European VAT Compliance Assistant for WooCommerce Web / CMS
  • High 8.1
    CVE-2026-10795 Public exploit

    UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc

    The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of …

    David Anderson UpdraftPlus: WP Backup & Migration Plugin Web / CMS
  • High 7.2
    CVE-2026-8438

    All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path

    The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the get_rest_route() function and missing output …

    David Anderson All-In-One Security (AIOS) – Security and Firewall Web / CMS
  • High 8.1
    CVE-2026-7252

    WP-Optimize <= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta

    The WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in al…

    David Anderson WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance Web / CMS
  • High 8.8
    CVE-2024-10957

    UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection

    The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserialization of untrusted input in the 'recursive_unserialized_replace' function. This makes it possible for…

    David Anderson UpdraftPlus: WP Backup & Migration Plugin Web / CMS
  • High 7.2
    CVE-2024-6828

    Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting

    The Redux Framework plugin for WordPress is vulnerable to unauthenticated JSON file uploads due to missing authorization and capability checks on the Redux_Color_Scheme_Import function in versions 4.4.12 to 4.4.17. This makes it possible for unauthenticated a…

    David Anderson Redux Framework Web / CMS