Skip to content
OpenAdvisories

Vendor

Marketing Fire

21 known vulnerabilities.

Products

Widget Options 7 Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets 4 Editorial Calendar 3 Widget Options - Extended 3 LoginWP - Pro 2 Discussion Board – WordPress Forum Plugin 2 Discussion Board 1
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-107765

    Discussion Board <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user_url) Field

    The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 via the user profile Website (user_url) field. This is due to insufficient output escaping in the ctdb_filt…

    Marketing Fire Discussion Board – WordPress Forum Plugin Web / CMS
  • Medium 6.5
    CVE-2024-35690

    WordPress Widget Options plugin <= 4.0.1 - Subscriber+ User Meta Data Exposure Vulnerability

    Insertion of sensitive information into sent data vulnerability in MarketingFire Widget Options allows Retrieve Embedded Sensitive Data. This issue affects Widget Options: from n/a through 4.0.1.

    Marketing Fire Widget Options
  • Medium 6.5
    CVE-2026-32361

    WordPress Editorial Calendar plugin <= 3.9.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marketing Fire Editorial Calendar editorial-calendar allows DOM-Based XSS.This issue affects Editorial Calendar: from n/a through <= 3.9.0.

    Marketing Fire Editorial Calendar
  • Medium 6.5
    CVE-2025-39561

    WordPress LoginWP - Pro Plugin <= 4.0.8.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Marketing Fire, LLC LoginWP - Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LoginWP - Pro: from n/a through 4.0.8.5.

    Marketing Fire LoginWP - Pro
  • Medium 4.3
    CVE-2025-69023

    WordPress Discussion Board plugin <= 2.5.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Marketing Fire Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Discussion Board: from n/a through <= 2.5.7.

    Marketing Fire Discussion Board
  • Medium 5.4
    CVE-2025-68603

    WordPress Editorial Calendar plugin <= 3.8.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Marketing Fire Editorial Calendar editorial-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Editorial Calendar: from n/a through <= 3.8.8.

    Marketing Fire Editorial Calendar
  • Medium 6.3
    CVE-2025-8483

    Discussion Board – WordPress Forum Plugin <= 2.5.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

    The The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.5.5. This is due to the software allowing users to execute an action that does not properly validate …

    Marketing Fire Discussion Board – WordPress Forum Plugin Web / CMS
  • Medium 6.4
    CVE-2025-10580

    Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple functions in all versions up to, and including, 4.1.2 due to insufficient input sanitization and output escaping…

    Marketing Fire Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets Web / CMS
  • Medium 6.4
    CVE-2025-8902

    Widget Options - Extended <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Widget Options - Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'do_sidebar' shortcode in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping on user supplied att…

    Marketing Fire Widget Options - Extended Web / CMS
  • Medium 4.3
    CVE-2025-22722

    WordPress Widget Options plugin <= 4.0.8 - Broken Access Control to Notice Dimissal vulnerability

    Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through <= 4.0.8.

    Marketing Fire Widget Options
  • Medium 4.3
    CVE-2024-56219

    WordPress Widget Options plugin <= 4.0.6.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through <= 4.0.6.1.

    Marketing Fire Widget Options
  • Medium 6.5
    CVE-2024-35691

    WordPress Widget Options - Extended plugin <= 5.1.0 - Multiple Data Exposure Vulnerability

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Marketing Fire, LLC Widget Options - Extended.This issue affects Widget Options - Extended: from n/a through 5.1.0.

    Marketing Fire Widget Options - Extended
  • Medium 5.4
    CVE-2023-36520

    WordPress Editorial Calendar Plugin <= 3.7.12 is vulnerable to Insecure Direct Object References (IDOR)

    Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar.This issue affects Editorial Calendar: from n/a through 3.7.12.

    Marketing Fire Editorial Calendar