Automattic Vaultpress vulnerabilities

2 CVEs affecting Automattic Vaultpress, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-125104, published 2023-06-01.

More from Automattic.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-20086, published 2022-06-23. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in VaultPress Plugin 1.8.4. This affects an unknown part. The manipulation leads to code injection. It is possible to initiate the attack…
• CVE-2014-125104, published 2023-06-01. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability was found in VaultPress Plugin up to 1.6.0 on WordPress. It has been declared as critical. Affected by this vulnerability is the function protect_aioseo_ajax of the file…