WordPress security by component
Garden Gnome Package
Plugin description
Garden Gnome Package is a WordPress component with 4 published CVE records in this archive. The latest tracked vulnerability was published Apr 08, 2026; the highest CVE/CNA score is 8.8.
Plugin slug:
garden-gnome-packageLatest vulnerability
CVE-2026-39683: Garden Gnome Package: Cross-site scripting
Garden Gnome Package is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.4.1.
| Safe version |
|
||
|---|---|---|---|
| Apr 08, 2026 |
CVE-2026-39683
Garden Gnome Package: Cross-site scripting
Garden Gnome Package is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.4.1.
|
> 2.4.1 |
CVE5.9
NVDPending
|
| Jan 08, 2025 |
CVE-2024-12854
Garden Gnome Package: Dangerous file upload
Garden Gnome Package is affected by dangerous file upload. Exploitation requires at least author-level access. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Sep 24, 2024 |
CVE-2024-8657
Garden Gnome Package: Cross-site scripting
Garden Gnome Package is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Nov 22, 2023 |
CVE-2023-5664
Garden Gnome Package: Cross-site scripting
Garden Gnome Package is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|