Seraphinite Accelerator
Approved changes feed: RSS · Atom
cpe:2.3:a:s-sols:seraphinite_accelerator:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | S Sols (7142b1fa-ffbf-509b-8b7e-f72301a1726b) |
|---|---|
| Product | Seraphinite Accelerator (19f83e43-201e-5094-ab67-04439cd69d3a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-3058 |
vulnerable | 2026-06-08 08:01:17.660629 |
Seraphinite Accelerator <= 2.28.14 - Authenticated (Subscriber+) Exposure of Sensitive Information to an Unauthorized Actor
MEDIUM (4.3)
The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28.14 via the `seraph_accel_api` AJAX action with `fn=GetData`. This is due to the `OnAdminApi_GetData()` function not performing any capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive operational data including cache status, scheduled task information, and external database state.
Published: 2026-03-04T11:22:31.410Z
Updated: 2026-04-08T17:19:26.805Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1568 |
vulnerable | 2026-06-08 06:27:13.462218 |
Seraphinite Accelerator <= 2.20.52 - Authenticated (Subscriber+) Server-Side Request Forgery in OnAdminApi_HtmlCheck
MEDIUM (6.4)
The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 via the OnAdminApi_HtmlCheck function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Published: 2024-02-28T06:46:47.074Z
Updated: 2026-04-08T16:33:55.854Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5611 |
vulnerable | 2026-06-08 06:19:44.151959 |
Seraphinite Accelerator < 2.20.32 - Unauthorised Settings Reset/Import
The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting and importing its settings, allowing unauthenticated users to reset them
Published: 2023-11-27T16:22:05.826Z
Updated: 2024-08-02T08:07:32.623Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5610 |
vulnerable | 2026-06-08 06:19:44.149934 |
Seraphinite Accelerator < 2.20.29 - Authenticated Arbitrary Redirect
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user to, leading to an arbitrary redirect
Published: 2023-11-20T18:55:09.577Z
Updated: 2024-08-02T08:07:32.179Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5609 |
vulnerable | 2026-06-08 06:19:44.149557 |
Seraphinite Accelerator < 2.20.29 - Reflected XSS
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Published: 2023-11-20T18:55:06.964Z
Updated: 2024-08-02T08:07:32.191Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-49740 |
vulnerable | 2026-06-08 06:16:10.344481 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.