Vulnerabilities in Kleor
6 resultsCVE-2025-9519HIGHEasy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via ShortcodeEPSS 0.9%CVE-2025-1028HIGHContact Manager <= 8.6.4 - Unauthenticated Arbitrary Double File Extension UploadEPSS 0.8%CVE-2026-109218CRITICALContact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist BypassEPSS 0.6%CVE-2025-68853HIGHWordPress Contact Manager plugin <= 9.1.1 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2025-8783MEDIUMContact Manager <= 8.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'title'EPSS 0.3%CVE-2026-32517HIGHWordPress Contact Manager plugin <= 9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%