Skip to content
OpenAdvisories

Vendor

wptobe

2 known vulnerabilities.

Products

Wptobe-memberships 1 Wptobe-signinup 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.1
    CVE-2025-9048

    Wptobe-memberships <= 3.4.2 - Authenticated (Subscriber+) Arbitrary File Deletion

    The Wptobe-memberships plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the del_img_ajax_call() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, …

    wptobe Wptobe-memberships Web / CMS
  • High 7.1
    CVE-2025-30611

    WordPress Wptobe-signinup plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wptobe Wptobe-signinup wptobe-signinup allows Reflected XSS.This issue affects Wptobe-signinup: from n/a through <= 1.1.2.

    wptobe Wptobe-signinup