Skip to content
OpenAdvisories

Vendor

investi

1 known vulnerabilities.

Products

Investi 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.4
    CVE-2026-3600

    Investi <= 1.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'maximum-num-years' Shortcode Attribute

    The Investi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'investi-announcements-accordion' shortcode's 'maximum-num-years' attribute in all versions up to, and including, 1.0.26. This is due to insufficient input sanitization and …

    investi Investi Web / CMS