Androidbubble develops a narrow set of WordPress plugins, including WP Docs and WP Sort Order, that extend content management and document handling on self-hosted WordPress installations. The durable signal in this vendor's disclosures centers on web-application input-handling and access-control weaknesses, including cross-site scripting, SQL injection, and missing authorization checks that are characteristic of plugin-layer functionality. Current vulnerability counts, severity, and exploitation status are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Androidbubble over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-30873HIGH Missing Authorization vulnerability in Fahad Mahmood WP Docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through 1. | Dec 9, 2024 | 8.8 | 24 | NO | NO |
CVE-2024-31294HIGH Missing Authorization vulnerability in Fahad Mahmood WP Sort Order.This issue affects WP Sort Order: from n/a through 1.3.1. | Jun 9, 2024 | 8.8 | 24 | NO | NO |
CVE-2024-12635MEDIUM The WP Docs plugin for WordPress is vulnerable to time-based SQL Injection via the 'dir_id' parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on th | Dec 21, 2024 | 6.5 | 19 | NO | NO |
CVE-2024-35696MEDIUM Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Fahad Mahmood WP Docs allows Reflected XSS.This issue affects WP Docs: | Jun 8, 2024 | 6.1 | 19 | NO | NO |
CVE-2024-56288MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood WP Docs wp-docs allows Stored XSS.This issue affects WP Docs: fr | Jan 7, 2025 | 4.8 | 15 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Androidbubble.
Media articles that mention a CVE ID that affects a product developed by Androidbubble — matched by CVE ID, not by vendor name.