VendorsVasylTechadvanced_access_managerany version
Vulnerabilities

VasylTech Advanced Access Manager any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

9CVEs
CVE-2019-25213
Advanced Access Manager <= 5.9.8.1 - Unauthenticated Arbitrary File Read
Published 2024-10-16 · Analyzed
9.8EPSS 0.028
CVE-2020-35935
The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.)
Published 2021-01-01 · Modified
8.8EPSS 0.015
CVE-2014-6059
WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite Vulnerability
Published 2020-01-13 · Modified
7.2EPSS 0.033
CVE-2024-29127
WordPress Advanced Access Manager plugin <= 6.9.20 - Reflected Cross Site Scripting (XSS) vulnerability
Published 2024-03-19 · Modified
7.1EPSS 0.004
CVE-2023-51674
WordPress Advanced Access Manager Plugin <= 6.9.18 is vulnerable to Cross Site Scripting (XSS)
Published 2024-02-01 · Modified
6.5EPSS 0.003
CVE-2023-50881
WordPress Advanced Access Manager Plugin <= 6.9.15 is vulnerable to Cross Site Scripting (XSS)
Published 2023-12-29 · Modified
6.5EPSS 0.003
CVE-2023-51675
WordPress Advanced Access Manager Plugin <= 6.9.18 is vulnerable to Open Redirection
Published 2023-12-29 · Modified
5.4EPSS 0.003
CVE-2021-24830
Advanced Access Manager < 6.8.0 - Admin+ Stored Cross-Site Scripting
Published 2021-11-23 · Modified
4.8EPSS 0.007
CVE-2020-35934
The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/authenticate or aam/v2/authenticate). This is a security problem if this object stores information that the user is not supposed to have (e.g., custom metadata added by a different plugin).
Published 2021-01-01 · Modified
4.3EPSS 0.011