WordPress security by component

WPAMS

Plugin description

WPAMS is a WordPress component with 8 published CVE records in this archive. The latest tracked vulnerability was published Jun 17, 2026; the highest CVE/CNA score is 10.

Plugin slug: apartment-management

Latest vulnerability

CVE-2026-39433: WPAMS: A security weakness

WPAMS is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a to < 49.5.3.

PublishedJun 17, 2026

Known safe version49.5.3

		Safe version
Jun 17, 2026	CVE-2026-39433 WPAMS: A security weakness WPAMS is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a to < 49.5.3.	49.5.3	CVE6.5 NVDPending
May 19, 2025	CVE-2025-39402 WPAMS: Dangerous file upload WPAMS is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE9.9 NVDPending
May 19, 2025	CVE-2025-39401 WPAMS: Dangerous file upload WPAMS is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE10.0 NVDPending
May 19, 2025	CVE-2025-39395 WPAMS: SQL injection WPAMS is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE9.3 NVDPending
May 19, 2025	CVE-2025-39392 WPAMS: Cross-site scripting WPAMS is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.1 NVDPending
May 19, 2025	CVE-2025-39406 WPAMS: Filesystem traversal WPAMS is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE9.8 NVDPending
May 19, 2025	CVE-2025-39405 WPAMS: Privilege escalation or authentication bypass WPAMS is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE8.8 NVDPending
May 19, 2025	CVE-2025-39403 WPAMS: SQL injection WPAMS is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE8.5 NVDPending