WordPress plugin
Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 21 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High4
- Medium14
- Low0
All Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.1 | Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta ≤5.1.1Update to 5.1.2 | CVE-2026-19942 | |
| Medium4.3 | Missing Authorization ≤4.3.2Update to 4.3.3 | CVE-2026-32447 | |
| Medium5.3 | Missing Authorization ≤4.2.1Update to 4.2.2 | CVE-2025-67993 | |
| Medium5.3 | Missing Authorization to Unauthenticated Arbitrary Post Deletion ≤4.0.9Update to 4.1.0 | CVE-2025-22657 | |
| Medium5.3 | Missing Authorization ≤4.3.1Update to 4.3.2 | CVE-2026-25019 | |
| Medium5.3 | Unauthenticated Information Exposure ≤4.2.1Update to 4.2.2 | CVE-2025-62895 | |
| Medium5.3 | Unauthenticated Information Exposure ≤4.2.1Update to 4.2.2 | CVE-2025-60188 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload ≤4.2.1Update to 4.2.2 | CVE-2025-60187 | |
| Critical9.8 | Unauthenticated Privilege Escalation ≤4.2.1Update to 4.2.2 | CVE-2025-60195 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤4.1.0Update to 4.1.1 | CVE-2025-26993 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤4.0.8Update to 4.0.9 | CVE-2025-24570 | |
| Medium5.3 | Missing Authorization to Authenticated (Subscriber+) Project Page/File Deletion ≤4.0.9Update to 4.1.0 | CVE-2024-12104 | |
| Medium5.3 | Missing Authorization via remove_feedbacktool_notice() ≤4.0.1Update to 4.0.2 | CVE-2024-43290 | |
| Medium5.4 | Missing Authorization to Authenticated (Subscriber+) Settings Update ≤4.0.2Update to 4.0.3 | CVE-2024-7621 | |
| Medium5.3 | Missing Authorization ≤4.0Update to 4.0.1 | CVE-2024-38771 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤3.31Update to 3.32 | CVE-2024-37434 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤3.30Update to 3.31 | CVE-2024-2793 | |
| High7.5 | Hardcoded Credentials ≤3.22.6Update to 3.30 | CVE-2024-2038 | |
| Medium6.1 | Unauthenticated Cross-Site Scripting ≤3.12Update to 3.13 | CVE-2023-47544 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤3.9.3Update to 3.9.4 | CVE-2023-37393 | |
| Critical9.1 | Client Interface <= 3.9.1 - Missing Authorization via AJAX actions <3.9.2Update to 3.9.2 | — |
- High8.1Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta
≤5.1.1Update to 5.1.2
- Medium4.3Missing Authorization
≤4.3.2Update to 4.3.3
- Medium5.3Missing Authorization
≤4.2.1Update to 4.2.2
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Post Deletion
≤4.0.9Update to 4.1.0
- Medium5.3Missing Authorization
≤4.3.1Update to 4.3.2
- Medium5.3Unauthenticated Information Exposure
≤4.2.1Update to 4.2.2
- Medium5.3Unauthenticated Information Exposure
≤4.2.1Update to 4.2.2
- Critical9.8Unauthenticated Arbitrary File Upload
≤4.2.1Update to 4.2.2
- Critical9.8Unauthenticated Privilege Escalation
≤4.2.1Update to 4.2.2
- Medium6.1Reflected Cross-Site Scripting
≤4.1.0Update to 4.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.0.8Update to 4.0.9
- Medium5.3Missing Authorization to Authenticated (Subscriber+) Project Page/File Deletion
≤4.0.9Update to 4.1.0
- Medium5.3Missing Authorization via remove_feedbacktool_notice()
≤4.0.1Update to 4.0.2
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Settings Update
≤4.0.2Update to 4.0.3
- Medium5.3Missing Authorization
≤4.0Update to 4.0.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤3.31Update to 3.32
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.30Update to 3.31
- High7.5Hardcoded Credentials
≤3.22.6Update to 3.30
- Medium6.1Unauthenticated Cross-Site Scripting
≤3.12Update to 3.13
- Medium6.1Reflected Cross-Site Scripting
≤3.9.3Update to 3.9.4
- Critical9.1Client Interface <= 3.9.1 - Missing Authorization via AJAX actions
<3.9.2Update to 3.9.2
Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback: common questions
Does Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback have known vulnerabilities?
Yes. VulnCrest Radar lists 21 known vulnerabilities in Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback: 3 critical, 4 high, 14 medium. None are known to affect version null.
How do I check which version of Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback vulnerability?
CVE-2026-19942, published Aug 18, 2026: Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta. Severity: High (CVSS 8.1).
Is any Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback vulnerability listed in CISA KEV?
No. None of the known Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback vulnerabilities is currently listed in the CISA KEV catalog.