Skip to content
OpenAdvisories

Vendor

Horea Radu

6 known vulnerabilities.

Products

Mesmerize Companion 2 Materialis Companion 2 One Page Express Companion 2
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-12027

    Mesmerize Companion <= 1.6.158 - Missing Authorization Authenticated (Subscriber+) Settings Update

    The Mesmerize Companion plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the "openPageInCustomizer" and "openPageInDefaultEditor" functions in all versions up to, and including, 1.6.158. T…

    Horea Radu Mesmerize Companion Web / CMS
  • Medium 4.3
    CVE-2026-24543

    WordPress Materialis Companion plugin <= 1.3.52 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Horea Radu Materialis Companion materialis-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Materialis Companion: from n/a through <= 1.3.52.

    Horea Radu Materialis Companion
  • Medium 4.3
    CVE-2025-62052

    WordPress One Page Express Companion plugin <= 1.6.43 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Horea Radu One Page Express Companion one-page-express-companion.This issue affects One Page Express Companion: from n/a through <= 1.6.43.

    Horea Radu One Page Express Companion
  • Medium 6.4
    CVE-2024-4703

    One Page Express Companion <= 1.6.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via one_page_express_contact_form Shortcode

    The One Page Express Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's one_page_express_contact_form shortcode in all versions up to, and including, 1.6.37 due to insufficient input sanitization and output escaping o…

    Horea Radu One Page Express Companion Web / CMS
  • Medium 6.4
    CVE-2024-4707

    Materialis Companion <= 1.3.41 - Authenticated (Contributor+) Store Cross-Site Scripting via materialis_contact_form Shortcode

    The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis_contact_form shortcode in all versions up to, and including, 1.3.41 due to insufficient input sanitization and output escaping on user suppl…

    Horea Radu Materialis Companion Web / CMS
  • Medium 6.4
    CVE-2024-3494

    Mesmerize Companion <= 1.6.148 - Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize_contact_form Shortcode

    The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerize_contact_form' shortcode in all versions up to, and including, 1.6.148 due to insufficient input sanitization and output escaping on user supp…

    Horea Radu Mesmerize Companion Web / CMS