# cve.now: Davidanderson

The newest entries naming Davidanderson as an affected vendor (up to 200), of 29 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-110534](https://cve.now/CVE-2026-110534.md): Redux Framework \<= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Scheme Name (CVSS 6.4)
- [CVE-2026-110705](https://cve.now/CVE-2026-110705.md): Redux Framework \<= 4.5.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download\_options… (CVSS 5.3)
- [CVE-2026-120533](https://cve.now/CVE-2026-120533.md): Redux Framework \<= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme\_opts Parameter via User Profile (CVSS 6.4)
- [CVE-2026-104812](https://cve.now/CVE-2026-104812.md): Redux Framework \<= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi\_media' Field Array Key (CVSS 6.4)
- [CVE-2026-103997](https://cve.now/CVE-2026-103997.md): Redux Framework \<= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via… (CVSS 6.5)
- [CVE-2026-102918](https://cve.now/CVE-2026-102918.md): Redux Framework \<= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi\_media Field and Client-Supplied checkuser\_id (CVSS 6.4)
- [CVE-2026-100316](https://cve.now/CVE-2026-100316.md): European VAT Compliance Assistant for WooCommerce \<= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header (CVSS 7.2)
- [CVE-2025-14123](https://cve.now/CVE-2025-14123.md): Redux Framework \<= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension (CVSS 6.8)
- [CVE-2026-90992](https://cve.now/CVE-2026-90992.md): Redux Framework \<= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field (CVSS 6.4)
- [CVE-2026-88999](https://cve.now/CVE-2026-88999.md): Redux Framework \<= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment\_id' Parameter (CVSS 4.3)
- [CVE-2026-5410](https://cve.now/CVE-2026-5410.md): Redux Framework \<= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input (CVSS 6.4)
- [CVE-2026-5400](https://cve.now/CVE-2026-5400.md): Redux Framework \<= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input (CVSS 6.4)
- [CVE-2026-5399](https://cve.now/CVE-2026-5399.md): Redux Framework \<= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value (CVSS 6.4)
- [CVE-2026-10795](https://cve.now/CVE-2026-10795.md): UpdraftPlus: WP Backup & Migration Plugin \<= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc (CVSS 8.1)
- [CVE-2026-8438](https://cve.now/CVE-2026-8438.md): All-In-One Security (AIOS) \<= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path (CVSS 7.2)
- [CVE-2026-7660](https://cve.now/CVE-2026-7660.md): Easy Updates Manager \<= 9.0.20 - Reflected Cross-Site Scripting via 'paged' Parameter (CVSS 6.1)
- [CVE-2026-7252](https://cve.now/CVE-2026-7252.md): WP-Optimize \<= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta (CVSS 8.1)
- [CVE-2024-13362](https://cve.now/CVE-2024-13362.md): Freemius \<= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter (CVSS 6.1)
- [CVE-2026-2712](https://cve.now/CVE-2026-2712.md): WP-Optimize \<= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation (CVSS 5.4)
- [CVE-2025-9488](https://cve.now/CVE-2025-9488.md): Redux Framework \<= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter (CVSS 6.4)
- [CVE-2024-13857](https://cve.now/CVE-2024-13857.md): WPGet API \<= 2.2.10 - Authenticated (Administrator+) Server-Side Request Forgery (CVSS 5.5)
- [CVE-2025-0215](https://cve.now/CVE-2025-0215.md): UpdraftPlus - Backup/Restore \<= 1.24.12 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-10957](https://cve.now/CVE-2024-10957.md): UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection (CVSS 8.8)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- [CVE-2024-6828](https://cve.now/CVE-2024-6828.md): Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2024-4193](https://cve.now/CVE-2024-4193.md): Testimonial Slider \<= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-0657](https://cve.now/CVE-2024-0657.md): Internal Link Juicer \<= 2.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4)
- [CVE-2024-1037](https://cve.now/CVE-2024-1037.md): All-In-One Security (AIOS) – Security and Firewall \<= 5.2.5 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2023-5982](https://cve.now/CVE-2023-5982.md): UpdraftPlus \<= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/davidanderson
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.