CVE-2019-15858

8.8 highEPSS 20%

High (8.8) in webcraftic woody ad snippets. EPSS 20% chance of exploitation in the next 30 days.

admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 20% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2019-09-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

webcraftic:woody_ad_snippets

References

https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-woody-ad-snippets-plugin-lead-to-remote-code-execution/
https://wpvulndb.com/vulnerabilities/9490
https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-woody-ad-snippets-plugin-lead-to-remote-code-execution/
https://wpvulndb.com/vulnerabilities/9490

Check your stack JSON