rafasashi vulnerabilities

CVEs per yearBy the year they were published

1. 20243
2. 20251
3. 20262

Newest CVEs

• CVE-2026-15341

  User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters

  rafasashi · User Session Synchronizer

  Critical9.8
• CVE-2026-3551

  Custom New User Notification <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'User Mail Subject' Setting

  rafasashi · Custom New User Notification

  Medium4.4
• CVE-2025-32612

  WordPress User Session Synchronizer plugin <= 1.4.0 - CSRF to Stored XSS vulnerability

  rafasashi · User Session Synchronizer

  High7.1
• CVE-2024-49648

  WordPress SVG Captcha plugin <= 1.0.11 - Reflected Cross Site Scripting (XSS) vulnerability

  rafasashi · SVG Captcha

  High7.1
• CVE-2024-49642

  WordPress Todo Custom Field plugin <= 3.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

  rafasashi · Todo Custom Field

  High7.1
• CVE-2024-9610

  Language Switcher <= 3.7.13 - Reflected Cross-Site Scripting

  rafasashi · Language Switcher

  Medium6.1