Skip to content
OpenAdvisories

Vendor

Kleor

6 known vulnerabilities.

Products

Contact Manager 5 Easy Timer 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.1
    CVE-2026-32517

    WordPress Contact Manager plugin <= 9.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kleor Contact Manager contact-manager allows Reflected XSS.This issue affects Contact Manager: from n/a through <= 9.1.

    Kleor Contact Manager
  • High 8.8
    CVE-2025-68853

    WordPress Contact Manager plugin <= 9.1.1 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Kleor Contact Manager contact-manager allows Object Injection.This issue affects Contact Manager: from n/a through <= 9.1.1.

    Kleor Contact Manager
  • High 7.2
    CVE-2025-9519 Public exploit

    Easy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode

    The Easy Timer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.1 via the plugin's shortcodes. This is due to insufficient restriction of shortcode attributes. This makes it possible for authenticated attac…

    Kleor Easy Timer Web / CMS
  • High 8.1
    CVE-2025-1028

    Contact Manager <= 8.6.4 - Unauthenticated Arbitrary Double File Extension Upload

    The Contact Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the contact form upload feature in all versions up to, and including, 8.6.4. This makes it possible for unauthenticated attackers to upload…

    Kleor Contact Manager Web / CMS