Every CVE whose affected-product data names Alex.kirk Friends, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (2)
CVE-2025-7504 — CVSS 7.5 (high): The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deserialization of untrusted input of the…
CVE-2024-1978 — CVSS 5.5 (medium): The Friends plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.5 via the…