Amauri

CVE-2026-61984 Aug 13, 13:36 HIGH This Week

WPMobile.App plugin for WordPress, versions 11.77 and earlier, allows unauthenticated remote attackers to bypass authorization controls and access protected resources. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects full network exploitability with high confidentiality impact and no integrity or availability consequence, consistent with an unauthorized read-access scenario. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2026-22809 Jan 13, 20:16 npm MEDIUM PATCH This Month

Tarteaucitronjs versions up to 1.29.0 is affected by inefficient regular expression complexity (redos) (CVSS 4.4).

CVE-2025-48939 Jul 03, 17:15 npm MEDIUM POC PATCH This Month

A security vulnerability in tarteaucitron.js (CVSS 4.2). Risk factors: public PoC available. Vendor patch is available.

CVE-2025-4955 Jun 18, 06:15 MEDIUM POC PATCH This Month

The tarteaucitron.io WordPress plugin before 1.9.5 uses query parameters from YouTube oEmbed URLs without sanitizing these parameters correctly, which could allow users with the contributor role and above to perform Stored Cross-site Scripting attacks.

CVE-2025-31476 Apr 07, 15:15 LIB MEDIUM PATCH Monitor

tarteaucitron.js is a compliant and accessible cookie banner. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2025-31475 Apr 07, 15:15 npm MEDIUM PATCH This Month

tarteaucitron.js is a compliant and accessible cookie banner. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. This Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) vulnerability could allow attackers to modify object prototypes to inject properties affecting application logic.

CVE-2025-31138 Apr 07, 15:15 npm MEDIUM PATCH This Month

tarteaucitron.js is a compliant and accessible cookie banner. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity.

CVE-2024-13888 Feb 20, 09:15 HIGH POC PATCH This Week

The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2024-35694 Jun 08, 15:15 HIGH POC This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.App: from n/a through <= 11.41. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-28932 May 10, 08:15 MEDIUM This Month

Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-26010 May 04, 14:15 MEDIUM This Month

Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-22702 Mar 23, 15:15 MEDIUM This Month

Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.