{"items":[{"id":"CVE-2025-9373","published":"2026-10-14T07:43:32.584Z","updated":"2026-10-15T16:43:49.219Z","title":"PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"MEDIUM","score":6.4,"vendor":"peprodev","product":"PeproDev Branches Map (Mapify)","kev":false,"epss":0.00245,"kevAdded":null,"exploit":false},{"id":"CVE-2026-4791","published":"2026-10-10T08:26:39.840Z","updated":"2026-10-11T12:13:43.385Z","title":"PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute","severity":"MEDIUM","score":6.4,"vendor":"peprodev","product":"PeproDev Ultimate Profile Solutions","kev":false,"epss":0.00185,"kevAdded":null,"exploit":false},{"id":"CVE-2025-3921","published":"2025-05-07T01:43:08.850Z","updated":"2025-05-07T14:03:00.745Z","title":"PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function","severity":"HIGH","score":8.2,"vendor":"peprodev","product":"PeproDev Ultimate Profile Solutions","kev":false,"epss":0.00457,"kevAdded":null,"exploit":false},{"id":"CVE-2025-3924","published":"2025-05-07T01:43:07.782Z","updated":"2025-05-07T14:03:17.735Z","title":"PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Unauthenticated Email Enumeration","severity":"MEDIUM","score":5.3,"vendor":"peprodev","product":"PeproDev Ultimate Profile Solutions","kev":false,"epss":0.00383,"kevAdded":null,"exploit":false},{"id":"CVE-2025-3844","published":"2025-05-07T01:43:07.411Z","updated":"2025-05-07T14:03:23.728Z","title":"PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Authentication Bypass to Account Takeover","severity":"CRITICAL","score":9.8,"vendor":"peprodev","product":"PeproDev Ultimate Profile Solutions","kev":false,"epss":0.00641,"kevAdded":null,"exploit":false},{"id":"CVE-2024-13719","published":"2025-02-19T07:32:07.577Z","updated":"2026-04-08T16:49:44.708Z","title":"PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure","severity":"MEDIUM","score":5.3,"vendor":"peprodev","product":"PeproDev Ultimate Invoice","kev":false,"epss":0.00477,"kevAdded":null,"exploit":false},{"id":"CVE-2024-8873","published":"2024-11-16T03:20:52.200Z","updated":"2026-04-08T17:28:44.419Z","title":"PeproDev WooCommerce Receipt Uploader <= 2.6.9 - Reflected Cross-Site Scripting","severity":"MEDIUM","score":6.1,"vendor":"peprodev","product":"PeproDev WooCommerce Receipt Uploader","kev":false,"epss":0.00509,"kevAdded":null,"exploit":false}]}