Skip to content
OpenAdvisories

Vendor

Soflyy

16 known vulnerabilities.

Products

WP All Import Pro 4 Breakdance 3 Oxygen Builder 2 WP All Import 2 Import any XML or CSV File to WordPress (WordPress plugin) 1 Import any XML or CSV File to WordPress 1 WP Wizard Cloak 1 WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel 1 WP Dynamic Links 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.5
    CVE-2026-65551

    WordPress Breakdance plugin < 2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7.

    Soflyy Breakdance
  • High 7.1
    CVE-2026-57735

    WordPress Breakdance plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.

    Soflyy Breakdance
  • High 7.1
    CVE-2025-53237

    WordPress WP Wizard Cloak Plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soflyy WP Wizard Cloak wp-wizard-cloak allows Reflected XSS.This issue affects WP Wizard Cloak: from n/a through <= 1.0.1.

    Soflyy WP Wizard Cloak
  • High 7.1
    CVE-2025-49038

    WordPress WP Dynamic Links plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soflyy WP Dynamic Links wp-dynamic-links allows Reflected XSS.This issue affects WP Dynamic Links: from n/a through <= 1.0.1.

    Soflyy WP Dynamic Links
  • High 7.2
    CVE-2024-9664

    WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import File

    The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserialization of untrusted input from an import file. This makes it possible for authenticated attackers, with Administrator-lev…

    Soflyy WP All Import Pro Web / CMS
  • High 7.6
    CVE-2024-9624

    WP All Import Pro <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import

    The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxi_curl_download function. This makes it possible for authenticated attackers, with Adm…

    Soflyy WP All Import Pro Web / CMS