Plugin icon

Stream

stream

Vulnerabilities:

7

Last Updated:

February 24, 2026

Active Installs:

80000

Published
Title
Fixed in
CVSS
Published
2025-02-14
Title
Stream < 4.1.0 - Authenticated (Admin+) Server-Side Request Forgery
Fixed in
Fixed in 4.1.0
CVSS
5.5 (medium)
Published
2024-09-12
Title
Stream < 4.0.2 - Cross-Site Request Forgery to Arbitrary Options Update
Fixed in
Fixed in 4.0.2
CVSS
8.8 (high)
Published
2023-04-25
Title
Stream < 3.9.3 - Missing Authorization via load_alerts_settings
Fixed in
Fixed in 3.9.3
CVSS
4.3 (medium)
Published
2023-04-18
Title
Stream < 3.9.3 - CSRF
Fixed in
Fixed in 3.9.3
CVSS
5.4 (medium)
Published
2023-01-16
Title
Stream < 3.9.2 - Subscriber+ Alert Creation
Fixed in
Fixed in 3.9.2
CVSS
4.3 (medium)
Published
2021-10-18
Title
Stream < 3.8.2 - Admin+ SQL Injection
Fixed in
Fixed in 3.8.2
CVSS
6.8 (medium)
Published
2016-05-31
Title
Stream <= 3.0.5 - Unauthenticated Events Export
Fixed in
Fixed in 3.0.6
CVSS
n/a