Is BadgeOS safe?

Every recorded flaw

• Jan 2, 2025BadgeOS: Missing AuthorizationCVE-2023-47647 · affects up to 3.7.1.6 · reported by PatchstackMedium 4.3
• Aug 31, 2023BadgeOS: Unauthorized modification of dataCVE-2023-2174 · affects up to 3.7.1.6 · reported by WordfenceMedium 4.3
• Aug 31, 2023BadgeOS: Insecure Direct Object ReferenceCVE-2023-2173 · affects up to 3.7.1.6 · reported by WordfenceMedium 6.5
• Aug 31, 2023BadgeOS: Insecure Direct Object ReferenceCVE-2023-2172 · affects up to 3.7.1.6 · reported by WordfenceMedium 4.3
• Aug 31, 2023BadgeOS: Stored Cross-Site ScriptingCVE-2023-2171 · affects up to 3.7.1.6 · reported by WordfenceMedium 5.4
• May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in LearningTimes BadgeOS plugin <= 3.7.1.6 versions.CVE-2022-41987 · affects up to 3.7.1.6 · reported by PatchstackMedium 6.3
• Sep 19, 2022BadgeOS: Does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated usersCVE-2022-2958 · fixed in 3.7.1.3 · reported by WPScan1.3% oddsHigh 8.8
• May 9, 2022BadgeOS: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX actionCVE-2022-0817 · affects up to 3.7.0 · reported by WPScan12% oddsCritical 9.8

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.