# cve.now: Creativemindssolutions

The newest entries naming Creativemindssolutions as an affected vendor (up to 200), of 31 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-16601](https://cve.now/CVE-2026-16601.md): CM Map Locations \<= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc\_route\_image\_upload AJAX Action (CVSS 8.8)
- [CVE-2026-8892](https://cve.now/CVE-2026-8892.md): CM Business Directory \<= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta Fields (CVSS 6.4)
- [CVE-2026-9236](https://cve.now/CVE-2026-9236.md): CM Ad Changer \<= 2.0.7 - Cross-Site Request Forgery to Campaign Deletion via Campaign Management (CVSS 4.3)
- [CVE-2026-2432](https://cve.now/CVE-2026-2432.md): CM Custom Reports \<= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels (CVSS 4.4)
- [CVE-2026-2431](https://cve.now/CVE-2026-2431.md): CM Custom Reports \<= 1.2.7 - Reflected Cross-Site Scripting via 'date\_from' and 'date\_to' Parameters (CVSS 6.1)
- [CVE-2026-25004](https://cve.now/CVE-2026-25004.md): WordPress CM Business Directory plugin \<= 1.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2026-0691](https://cve.now/CVE-2026-0691.md): CM E-Mail Blacklist \<= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black\_email' Parameter (CVSS 4.4)
- [CVE-2025-54045](https://cve.now/CVE-2025-54045.md): WordPress CM On Demand Search And Replace plugin \<= 1.5.5 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-11167](https://cve.now/CVE-2025-11167.md): CM Registration – Tailored tool for seamless login and invitation-based registrations \<= 2.5.6 - Open Redirect (CVSS 4.7)
- [CVE-2025-10178](https://cve.now/CVE-2025-10178.md): CM Business Directory \<= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-48151](https://cve.now/CVE-2025-48151.md): WordPress CM Map Locations \<= 2.1.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1)
- [CVE-2025-54727](https://cve.now/CVE-2025-54727.md): WordPress CM On Demand Search And Replace Plugin \<= 1.5.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
- [CVE-2025-54728](https://cve.now/CVE-2025-54728.md): WordPress CM On Demand Search And Replace Plugin \<= 1.5.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
- [CVE-2025-54018](https://cve.now/CVE-2025-54018.md): WordPress CM Pop-Up banners plugin \<= 1.8.4 - Broken Access Control Vulnerability (CVSS 4.3)
- [CVE-2025-46246](https://cve.now/CVE-2025-46246.md): WordPress CM Answers plugin \<= 3.3.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
- [CVE-2025-46245](https://cve.now/CVE-2025-46245.md): WordPress CM Ad Changer plugin \<= 2.0.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
- [CVE-2025-32210](https://cve.now/CVE-2025-32210.md): WordPress CM Registration and Invitation Codes plugin \<= 2.5.6 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-31091](https://cve.now/CVE-2025-31091.md): WordPress CM Header and Footer plugin \<= 1.2.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-30910](https://cve.now/CVE-2025-30910.md): WordPress CM Download Manager plugin \<= 2.9.6 - Arbitrary File Deletion vulnerability (CVSS 8.6)
- [CVE-2025-2166](https://cve.now/CVE-2025-2166.md): CM FAQ – Simplify support with an intuitive FAQ management tool \<= 1.2.5 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2025-24758](https://cve.now/CVE-2025-24758.md): WordPress CM Map Locations plugin \<= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-24694](https://cve.now/CVE-2025-24694.md): WordPress CM Pop-Up Banners plugin \<= 1.7.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-54267](https://cve.now/CVE-2024-54267.md): WordPress CM Answers plugin \<= 3.2.6 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-11202](https://cve.now/CVE-2024-11202.md): Multiple Plugins \<= (Various Versions) - Reflected Cross-Site Scripting via cminds\_free\_guide Shortcode (CVSS 6.1)
- [CVE-2024-48041](https://cve.now/CVE-2024-48041.md): WordPress CM Tooltip Glossary plugin \<= 4.3.9 - Stored Cross-Site Scripting vulnerability (CVSS 6.5)
- [CVE-2024-43149](https://cve.now/CVE-2024-43149.md): WordPress CM Tooltip Glossary Plugin \<= 4.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-4086](https://cve.now/CVE-2024-4086.md): CM Tooltip Glossary – Powerful Glossary Plugin \<= 4.2.11 - Cross-Site Request Forgery (CVSS 4.3)
- [CVE-2023-30750](https://cve.now/CVE-2023-30750.md): WordPress CM Pop-Up banners Plugin \<= 1.5.10 is vulnerable to SQL Injection (CVSS 8.5)
- [CVE-2023-28749](https://cve.now/CVE-2023-28749.md): WordPress CM On Demand Search And Replace Plugin \<= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-31228](https://cve.now/CVE-2023-31228.md): WordPress CM On Demand Search And Replace Plugin \<= 1.3.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2023-25992](https://cve.now/CVE-2023-25992.md): WordPress CM Answers Plugin \<= 3.1.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/creativemindssolutions
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.