GCVE - cpe:2.3:a:xwp:stream:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:xwp:stream:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Xwp (`04b62bbe-68d9-5dfd-9f8b-88a19e411b32`)
Product	Stream (`39b9a5d5-25db-5174-bb81-5c275d5b6dfe`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/xwp/stream`	purl2cpe	2026-06-01 10:14:44.719285

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-7423`	vulnerable	2026-06-08 06:58:22.152596	Stream <= 4.0.1 - Cross-Site Request Forgery to Arbitrary Options Update HIGH (8.8) The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. This is due to missing or incorrect nonce validation on the network_options_action() function. This makes it possible for unauthenticated attackers to update arbitrary options that can lead to DoS or privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Published: 2024-09-13T15:10:40.919Z Updated: 2026-04-08T17:11:32.200Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/9d15e418-36bb-4f53-ac67-8f6122591dd2?source=cve https://plugins.trac.wordpress.org/browser/stream/tags/4.0.1/classes/class-network.php#L353 https://plugins.trac.wordpress.org/changeset/3139815/stream/trunk/classes/class-network.php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-13879`	vulnerable	2026-06-08 06:25:38.684716	Stream <= 4.0.2 - Authenticated (Admin+) Server-Side Request Forgery MEDIUM (5.5) The Stream plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.2 due to insufficient validation on the webhook feature. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services. Published: 2025-02-17T15:21:19.607Z Updated: 2026-04-08T17:04:49.373Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/8680ad0a-7513-408d-a62d-ffb0b0e7addb?source=cve https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3226637%40stream&new=3226637%40stream&sfp_email=&sfph_mail= https://github.com/xwp/stream/blob/develop/changelog.md#410---january-15-2025	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-43490`	vulnerable	2026-06-08 05:49:32.138294	WordPress Stream Plugin <= 3.9.2 is vulnerable to Cross Site Request Forgery (CSRF) MEDIUM (5.4) Cross-Site Request Forgery (CSRF) vulnerability in XWP Stream plugin <= 3.9.2 versions. Published: 2023-05-25T10:17:18.016Z Updated: 2026-04-28T16:07:50.819Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/stream/wordpress-stream-plugin-3-9-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-43450`	vulnerable	2026-06-08 05:49:31.984780	WordPress Stream Plugin <= 3.9.2 is vulnerable to Insecure Direct Object References (IDOR) MEDIUM (4.3) Authorization Bypass Through User-Controlled Key vulnerability in XWP Stream.This issue affects Stream: from n/a through 3.9.2. Published: 2023-12-19T21:24:05.517Z Updated: 2026-04-28T16:07:50.669Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/stream/wordpress-stream-plugin-3-9-2-auth-insecure-direct-object-references-idor-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Stream

Notes

PURL mappings

Vulnerability references

Contribute