Wppool maintains a focused portfolio of WordPress plugins including WP Dark Mode and Sheets to WP Table Live Sync, targeting WordPress site customization and data integration use cases. The observed vulnerability exposure centers on web-application input and access-control weaknesses, notably cross-site request forgery, path traversal, and missing authorization checks, which are characteristic of plugin-layer code running within shared WordPress environments. Current severity and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Wppool over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-26535HIGH Cross-Site Request Forgery (CSRF) vulnerability in WPPOOL Sheets To WP Table Live Sync plugin <= 2.12.15 versions. | Nov 22, 2023 | 8.8 | 24 | NO | NO |
CVE-2024-34375MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Sheets To WP Table Live Sync allows Stored XSS.This issue affects Sheet | May 6, 2024 | 5.9 | 17 | NO | NO |
CVE-2023-0467MEDIUM The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template. This leads to Local File Inclusi | Mar 27, 2023 | 4.3 | 17 | NO | NO |
CVE-2024-5449MEDIUM The WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is vulnerable to unauthorized modification | Jun 6, 2024 | 4.3 | 15 | NO | NO |
CVE-2022-4714MEDIUM The WP Dark Mode WordPress plugin before 4.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform St | Feb 21, 2023 | 5.4 | 15 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Wppool.
Media articles that mention a CVE ID that affects a product developed by Wppool — matched by CVE ID, not by vendor name.