CVEs we hold for Simple
Records whose assigning authority named Simple as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-88764Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_refUnknown Simple Membership
CVE-2026-85116Simple CAPTCHA with Cloudflare Turnstile 1.2.2 - 1.42.1 - Unauthenticated Arbitrary Shortcode Execution via Contact…Unknown Simple CAPTCHA with Cloudflare Turnstile
CVE-2026-81807Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message LinkificationUnknown Simple Ajax Chat
CVE-2026-8151Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRFUnknown Simple Membership MailChimp Integration
CVE-2026-78146Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions PageUnknown Simple Newsletter Plugin
CVE-2026-49284SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a…simplesamlphp
CVE-2026-49283SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypasssimplesamlphp saml2
CVE-2026-48558SimpleHelp Authentication Bypass via Missing OIDC JWT Signature VerificationSimpleHelp
CVE-2026-46491SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and…simplesamlphp-module-casserver
CVE-2026-43621Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()SimpleMachines SMF
CVE-2026-39903Simple Machines Forum Authorization Bypass via AttachmentApprove.phpSimpleMachines SMF
CVE-2026-34907Reflected Cross-Site Scripting (XSS) in Wirtualna UczelniaSimple SA Wirtualna Uczelnia
CVE-2026-34906Server-Side Template Injection (SSTI) in Wirtualna UczelniaSimple SA Wirtualna Uczelnia
CVE-2026-32600xml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryptionsimplesamlphp xml-security
CVE-2026-19714Simple JWT Login < 3.6.8 - Unauthenticated Account Takeover via Missing Google id_token Audience ValidationUnknown Simple JWT Login
CVE-2026-16617Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File DescriptionUnknown Simple File List
CVE-2026-16616Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path TraversalUnknown Simple File List
CVE-2026-16536Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_idUnknown Simple Google Calendar Outlook Events Widget
CVE-2026-15939Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST APIUnknown Simple Restrict
CVE-2026-15931Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber NameUnknown Simple Membership
CVE-2026-15930Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username CollisionUnknown Simple Membership
CVE-2026-15239Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator…Unknown Simple CAPTCHA with Cloudflare Turnstile
CVE-2026-14936Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver VerificationUnknown Simple Membership
CVE-2026-11855Simple Membership < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API VersionUnknown Simple Membership
CVE-2025-68979WordPress Google Calendar Events plugin <= 3.5.9 - Insecure Direct Object References (IDOR) vulnerabilitySimpleCalendar Google Calendar Events
CVE-2025-65954SimpleSAMLphp-casserver has an Open Redirect vulnerability via logoutsimplesamlphp-module-casserver
CVE-2025-39424WordPress Simple Maps plugin <= 0.98 - CSRF to XSS vulnerabilitysimplemaps Simple Maps
CVE-2025-31386WordPress Simple:Press plugin <= 6.11.5 - Broken Access Control vulnerabilitysimplepress Simple:Press
CVE-2025-30922WordPress Simplebooklet PDF Viewer and Embedder plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilitySimplebooklet PDF Viewer and Embedder
CVE-2025-27773SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect bindingsimplesamlphp saml2
CVE-2025-0692Simple Video Management System <= 1.0.4 - Admin+ Stored XSSUnknown Simple Video Management System
CVE-2024-8549Simple Calendar – Google Calendar Plugin <= 3.4.2 - Reflected Cross-Site Scriptingsimplecalendar Simple Calendar – Google Calendar Plugin
CVE-2024-7438SimpleMachines SMF User Alert Read Status index.php resource injectionSimpleMachines SMF
CVE-2024-5570Simple Photoswipe <= 0.1 - Subscriber+ Arbitrary Settings UpdateUnknown Simple Photoswipe
CVE-2024-51574WordPress Simple Goods plugin <= 0.1.3 - Stored Cross Site Scripting (XSS) vulnerabilitySimple Goods
CVE-2024-4094Simple Share Buttons Adder < 8.5.1 - Admin+ Stored XSSUnknown Simple Share Buttons Adder
CVE-2024-30483WordPress Sponsors plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerabilitySimple Sponsorships Sponsors
CVE-2024-2858Simple Buttons Creator <= 1.04 - Aribtrary Button Deletion via CSRFUnknown Simple Buttons Creator
CVE-2024-2857Simple Buttons Creator <= 1.04 - Unauthenticated Stored XSSUnknown Simple Buttons Creator
CVE-2024-27115Remote Code Execution through File Upload in SOPlanning before 1.52.02Simple Online Planning SO Planning
CVE-2024-27114Remote Code Execution through File Upload in SOPlanning before 1.52.02Simple Online Planning SO Planning
CVE-2024-27113Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02Simple Online Planning SO Planning
CVE-2024-13610Simple Social Media Share Buttons < 6.0.0 - Admin+ Stored XSSUnknown Simple Social Media Share Buttons
CVE-2024-13518Simple:Press <= 6.10.12 - Cross-Site Request Forgery to Unauthorized Post Editingsimplepress Simple:Press Forum
CVE-2024-12716Simple Basic Contact Form < 20250114 - Admin+ Stored XSSUnknown Simple Basic Contact Form
CVE-2024-12409Simple:Press Forum <= 6.10.11 - Reflected Cross-Site Scriptingsimplepress Simple:Press Forum
CVE-2024-10884SimpleForm Contact Form Submissions <= 2.1.0 - Reflected Cross-Site ScriptingSimpleForm Contact Form Submissions
CVE-2024-10883SimpleForm – Contact form made simple <= 2.2.0 - Reflected Cross-Site ScriptingSimpleForm – Contact form made simple
CVE-2024-10152Simple Certain Time to Show Content < 1.3.1 - Reflected XSSUnknown Simple Certain Time to Show Content
CVE-2023-5845Simple Social Buttons < 5.1.1 - Unauthenticated Password Protected Post AccessUnknown Simple Social Media Share Buttons
CVE-2023-5566Simple Shortcodes <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodesimplethemes Simple Shortcodes
CVE-2023-49151WordPress Google Calendar Events Plugin <= 3.2.6 is vulnerable to Cross Site Scripting (XSS)Simple Calendar – Google Calendar Plugin
CVE-2023-4858WP Simple Table Manager Plugin <= 1.5.6 - Admin+ Stored Cross-Site ScriptingUnknown Simple Table Manager
CVE-2023-46189WordPress Google Calendar Events Plugin <= 3.2.5 is vulnerable to Cross Site Request Forgery (CSRF)Simple Calendar – Google Calendar Plugin
CVE-2023-4035Simple Blog Card < 1.31 - Contributor+ Stored XSS via ShortcodeUnknown Simple Blog Card
CVE-2023-3601Simple Author Box < 2.52 - Contributor+ Arbitrary User Information Disclosure via IDORUnknown Simple Author Box
CVE-2023-3540SimplePHPscripts NewsLetter Script PHP URL Parameter preview.php cross site scriptingSimplePHPscripts NewsLetter Script PHP
CVE-2023-3539SimplePHPscripts Simple Forum PHP URL Parameter preview.php cross site scriptingSimplePHPscripts Simple Forum PHP
CVE-2023-3538SimplePHPscripts Photo Gallery PHP URL Parameter preview.php cross site scriptingSimplePHPscripts Photo Gallery PHP
CVE-2023-3537SimplePHPscripts News Script PHP Pro URL Parameter preview.php cross site scriptingSimplePHPscripts News Script PHP Pro
CVE-2023-3536SimplePHPscripts Funeral Script PHP URL Parameter preview.php cross site scriptingSimplePHPscripts Funeral Script PHP
CVE-2023-3535SimplePHPscripts FAQ Script PHP URL Parameter preview.php cross site scriptingSimplePHPscripts FAQ Script PHP
CVE-2023-3476SimplePHPscripts GuestBook Script URL Parameter preview.php cross site scriptingSimplePHPscripts GuestBook Script
CVE-2023-3475SimplePHPscripts Event Script URL Parameter preview.php cross site scriptingSimplePHPscripts Event Script
CVE-2023-3474SimplePHPscripts Simple Blog URL Parameter preview.php cross site scriptingSimplePHPscripts Simple Blog
CVE-2023-3465SimplePHPscripts Classified Ads Script HTTP POST Request user.php cross site scriptingSimplePHPscripts Classified Ads Script
CVE-2023-3464SimplePHPscripts Classified Ads Script URL Parameter preview.php cross site scriptingSimplePHPscripts Classified Ads Script
CVE-2023-2863Simple Design Daily Journal SQLite Database cleartext storage in a file or on diskSimple Design Daily Journal
CVE-2023-1558Simple and Beautiful Shopping Cart System uploadera.php unrestricted uploadn/a Simple and Beautiful Shopping Cart System
CVE-2023-1415Simple Art Gallery adminHome.php sliderPicSubmit unrestricted uploadn/a Simple Art Gallery
CVE-2023-1122Simple Giveaways < 2.45.1 - Editor+ Stored Cross-Site ScriptingUnknown Simple Giveaways
CVE-2022-4764Simple File Downloader <= 1.0.4 - Contributor+ Stored XSS via ShortcodeUnknown Simple File Downloader
CVE-2022-47178WordPress Simple Share Buttons Adder Plugin <= 8.4.7 is vulnerable to Cross Site Request Forgery (CSRF)Simple Share Buttons Adder
CVE-2022-4226Simple Basic Contact Form < 20221201 - Admin+ Stored XSSUnknown Simple Basic Contact Form
CVE-2022-4031Simple:Press <= 6.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Modificationsimplepress Simple:Press Forum
CVE-2022-4030Simple:Press <= 6.8 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Deletionsimplepress Simple:Press Forum
CVE-2022-4029Simple:Press <= 6.8 - Reflected Cross-Site Scripting via Cookie Valuesimplepress Simple:Press Forum
CVE-2022-4028Simple:Press <= 6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Signaturessimplepress Simple:Press Forum
CVE-2022-4027Simple:Press <= 6.8 - Unauthenticated Stored Cross-Site Scripting via Forum Repliessimplepress Simple:Press Forum
CVE-2022-2565Best Payments Plugin for WP < 4.2.1 - Unauthenticated Stored Cross-Site ScriptingUnknown Simple Payment Donations & Subscriptions Plugin by…
CVE-2022-2558Simple Job Board < 2.10.0 - Resume Disclosure via Directory ListingUnknown Simple Job Board
CVE-2022-2341Simple Page Transition <= 1.4.1 - Admin+ Stored Cross-Site ScriptingUnknown Simple Page Transition
CVE-2022-2317Simple Membership < 4.1.3 - Unauthenticated Membership Privilege EscalationUnknown Simple Membership
CVE-2022-22734Simple Quotation <= 1.3.2 - Quote Creation/Edition via CSRF to Stored Cross-Site ScriptingUnknown Simple Quotation
CVE-2022-2186Simple Post Notes < 1.7.6 - Admin+ Stored Cross-Site ScriptingUnknown Simple Post Notes
CVE-2022-1646Simple Real Estate Pack <= 1.4.8 - Admin+ Stored Cross Site ScriptingUnknown Simple Real Estate Pack
CVE-2022-0760Simple Link Directory < 7.7.2 - Unauthenticated SQL injectionUnknown Simple Link Directory
CVE-2022-0681Simple Membership < 4.1.0 - Arbitrary Transaction Deletion via CSRFUnknown Simple Membership
CVE-2022-0328Simple Membership < 4.0.9 - Arbitrary Member Deletion via CSRFUnknown Simple Membership
CVE-2021-47919Simple CMS 2.1 Non-Persistent Cross-Site Scripting via Preview ParameterSimplephpscripts Simple CMS
CVE-2021-47918Simple CMS 2.1 SQL Injection Vulnerability via Users ModuleSimplephpscripts Simple CMS
CVE-2021-47917Simple CMS 2.1 Persistent Cross-Site Scripting via User Input ParametersSimplephpscripts Simple CMS
CVE-2021-38339Simple Matted Thumbnails <= 1.01 Reflected Cross-Site ScriptingSimple Matted Thumbnails
CVE-2021-38320simpleSAMLphp Authentication <= 0.7.0 Reflected Cross-Site ScriptingsimpleSAMLphp Authentication
CVE-2021-34658Simple Popup Newsletter <= 1.4.7 Reflected Cross-Site ScriptingSimple Popup Newsletter
CVE-2021-34649Simple Behance Portfolio <= 0.2 Reflected Cross-Site ScriptingSimple Behance Portfolio
CVE-2021-24804Simple JWT Login < 3.2.1 - Arbitrary Settings Update to Site Takeover via CSRFUnknown Simple JWT Login – Login and Register to WordPress…
CVE-2021-24698Simple Download Monitor < 3.9.6 - Arbitrary Thumbnails RemovalUnknown Simple Download Monitor
CVE-2021-24697Simple Download Monitor < 3.9.5 - Reflected Cross-Site ScriptingUnknown Simple Download Monitor
CVE-2021-24695Simple Download Monitor < 3.9.6 - Unauthenticated Log AccessUnknown Simple Download Monitor
CVE-2021-24694Simple Download Monitor < 3.9.11 - Contributor+ Stored Cross-Site Scripting via ShortcodesUnknown Simple Download Monitor
CVE-2021-24693Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File ThumbnailUnknown Simple Download Monitor
CVE-2021-24692Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path TraversalUnknown Simple Download Monitor
CVE-2021-24663Simple School Staff Directory <= 1.1 - Admin+ Arbitrary File UploadUnknown Simple Schools Staff Directory
CVE-2021-24656Simple Social Media Share Buttons < 3.2.4 - Authenticated Stored Cross-Site ScriptingUnknown Simple Social Media Share Buttons – Social Sharing…
CVE-2021-24567Simple Post <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS)Unknown Simple Post
CVE-2021-24552Simple Events Calendar <= 1.4.0 - Authenticated (admin+) SQL InjectionUnknown Simple Events Calendar
CVE-2021-24486Simple Social Media Share Buttons < 3.2.3 - Contributor+ Stored XSSUnknown Simple Social Media Share Buttons – Social Sharing…
CVE-2021-24356Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Arbitrary Plugin ActivationUnknown Simple 301 Redirects by BetterLinks
CVE-2021-24355Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Update and Retrieve Wildcard ValueUnknown Simple 301 Redirects by BetterLinks
CVE-2021-24354Simple 301 Redirects by BetterLinks - 2.0.0-2.0.3 - Arbitrary Plugin InstallationUnknown Simple 301 Redirects by BetterLinks
CVE-2021-24353Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect ImportUnknown Simple 301 Redirects by BetterLinks
CVE-2021-24352Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect ExportUnknown Simple 301 Redirects by BetterLinks
CVE-2020-36706Simple:Press – WordPress Forum Plugin <= 6.6.0 - Arbitrary File Uploadsimplepress Simple:Press Forum
CVE-2020-15131False-positive validity for NFT1 genesis transactions in SLP Validatesimpleledger slp-validate.js
CVE-2020-11072False-negative validation results in MINT transactions with invalid batonsimpleledger slp-validate
CVE-2020-11071False-negative validation results in MINT transactions with invalid batonsimpleledger slpjs
CVE-2020-11014BIP LI01 output reordering may cause malformed SLP MINT transactions in Electron-Cash-SLPsimpleledger Electron-Cash-SLP
200 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.