Skip to content
OpenAdvisories

Vendor

plainware

16 known vulnerabilities.

Products

Locatoraid Store Locator 8 ShiftController Employee Shift Scheduling 5 PlainInventory 3
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.1
    CVE-2025-32623

    WordPress PlainInventory plugin <= 3.1.9 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in plainware PlainInventory z-inventory-manager allows Stored XSS.This issue affects PlainInventory: from n/a through <= 3.1.9.

    plainware PlainInventory
  • High 7.1
    CVE-2025-24557

    WordPress PlainInventory plugin <= 3.1.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware PlainInventory z-inventory-manager allows Reflected XSS.This issue affects PlainInventory: from n/a through <= 3.1.5.

    plainware PlainInventory
  • High 8.1
    CVE-2024-56283

    WordPress Locatoraid Store Locator Plugin <= 3.9.50 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in plainware Locatoraid Store Locator locatoraid allows Object Injection.This issue affects Locatoraid Store Locator: from n/a through <= 3.9.50.

    plainware Locatoraid Store Locator
  • High 8.1
    CVE-2024-56291

    WordPress PlainInventory – Inventory Management Plugin Plugin <= 3.1.6 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in plainware PlainInventory z-inventory-manager allows Object Injection.This issue affects PlainInventory: from n/a through <= 3.1.6.

    plainware PlainInventory
  • High 7.5
    CVE-2024-4733

    ShiftController Employee Shift Scheduling <= 4.9.57 - Authenticated (Contributor+) PHP Object Injection

    The ShiftController Employee Shift Scheduling plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the `hc3_session`-cookie in versions up to, and including, 4.9.57. This makes it possible for an authenticated attacker with …

    plainware ShiftController Employee Shift Scheduling
  • High 7.1
    CVE-2023-29424

    WordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.23 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Plainware ShiftController Employee Shift Scheduling plugin <= 4.9.23 versions.

    plainware ShiftController Employee Shift Scheduling