Skip to content
OpenAdvisories

Product · mischiefmarmot

Create

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-13200

    Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter

    The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL que…

    mischiefmarmot Create Web / CMS
  • Medium 6.5
    CVE-2026-13191

    Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order_by' Parameter

    The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL …

    mischiefmarmot Create Web / CMS
  • Medium 6.4
    CVE-2024-5601

    Create by Mediavine <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Schema Meta Shortcode

    The Create by Mediavine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Schema Meta shortcode in all versions up to, and including, 1.9.7 due to insufficient input sanitization and output escaping on user supplied attributes…

    mischiefmarmot Create Web / CMS