ITERAS
ITERAS has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.
Every one of the 2 issues recorded for ITERAS has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. ITERAS is installed on roughly 30 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2026-4078ITERAS <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Read the full analysisVulnerability Records
ITERAS
Author
ITERAS
ITERAS is a complete system for managing subscriptions for print and digital magazines. We automate as many of the hassles of billing as possible and offer you a choice of a wide range of billing methods. If you publish a printed publication in Denmark and Norway you will likely need to be able to send “indbetalingskort”/”girokort” which we have fully automated. We also integrate with the Danish NemHandel (EAN). Therefore, Iteras is a one-stop solution for Danish and Norwegian magazines and others with similar needs (foreninger, software providers, etc.). For more information, check out iteras.com. This plugin allows you to integrate the ordering and self-service parts of ITERAS easily, and set up a paywall in WordPress to only allow access to certain posts to your ITERAS subscribers. The plugin uses the ITERAS Javascript API, allowing further customizations for those who need it.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C