Skip to content
OpenAdvisories

Vendor

Stiofan

13 known vulnerabilities.

Products

UsersWP 5 GetPaid 3 BlockStrap Page Builder - Bootstrap Blocks 2 Events Calendar for GeoDirectory 2 AyeCode Connect 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.1
    CVE-2026-115609

    WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan GetPaid invoicing allows Stored XSS.This issue affects GetPaid: from n/a through 2.8.62.

    Stiofan GetPaid
  • High 7.1
    CVE-2026-94632

    WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Reflected XSS.This issue affects BlockStrap Page Builder - Bootstrap…

    Stiofan BlockStrap Page Builder - Bootstrap Blocks
  • High 7.1
    CVE-2026-94641 Public exploit

    WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflected XSS.This issue affects UsersWP: from n/a through 1.2.73.

    Stiofan UsersWP
  • High 8.8
    CVE-2026-39532

    WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.

    Stiofan Events Calendar for GeoDirectory
  • High 7.5
    CVE-2026-49064

    WordPress GetPaid plugin <= 2.8.49 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve Embedded Sensitive Data. This issue affects GetPaid: from n/a through 2.8.49.

    Stiofan GetPaid
  • High 8.8
    CVE-2025-26967

    WordPress Events Calendar for GeoDirectory plugin <= 2.3.14 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Stiofan Events Calendar for GeoDirectory events-for-geodirectory allows Object Injection.This issue affects Events Calendar for GeoDirectory: from n/a through <= 2.3.14.

    Stiofan Events Calendar for GeoDirectory