Wp Last Modified Info
Approved changes feed: RSS · Atom
cpe:2.3:a:infosatech:wp_last_modified_info:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Infosatech (66fe5cee-d0a2-5d58-8832-410fa9e9627c) |
|---|---|
| Product | Wp Last Modified Info (6ebf8d80-4857-50a3-8c6c-f962d4bbdce4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-14608 |
vulnerable | 2026-06-08 07:06:34.828812 |
WP Last Modified Info <= 1.9.5 - Insecure Direct Object Reference to Authenticated (Author+) Post Metadata Modification
MEDIUM (5.3)
The WP Last Modified Info plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.5. This is due to the plugin not validating a user's access to a post before modifying its metadata in the 'bulk_save' AJAX action. This makes it possible for authenticated attackers, with Author-level access and above, to update the last modified metadata and lock the modification date of arbitrary posts, including those created by Administrators via the 'post_ids' parameter.
Published: 2026-02-14T03:25:28.248Z
Updated: 2026-04-08T17:23:18.991Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6864 |
vulnerable | 2026-06-08 06:58:20.619233 |
WP Last Modified Info <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via lmt-post-modified-info Shortcode
MEDIUM (6.4)
The WP Last Modified Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘template’ attribute of the lmt-post-modified-info shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2024-08-20T04:28:33.896Z
Updated: 2026-04-08T17:05:01.529Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.