IP2Location vulnerabilities (CVEs)

Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

• CVE-2021-25096 ↗EPSS 1.0%LEV ≥45%Elevated risk

  The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL

• CVE-2021-25095 ↗EPSS 0.5%LEV ≥27%Elevated risk

  The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX ac…

• CVE-2025-1361 ↗EPSS 1.3%LEV ≥23%Elevated risk

  The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing c…

• CVE-2021-25108 ↗EPSS 0.5%LEV ≥23%Elevated risk

  The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing atta…

• CVE-2024-22294 ↗EPSS 0.5%LEV ≥14%Elevated risk

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in IP2Location IP2Location Country Blocker.This issue affects IP2Location Country Block…

• CVE-2023-37865 is now estimated at a 11% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
• CVE-2021-25096 is now estimated at a 44% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗
• CVE-2021-25108 is now estimated at a 22% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗
• CVE-2021-25095 is now estimated at a 26% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗
• CVE-2023-37865 is now estimated at a 11% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

• CVE-2026-82530 ↗MEDIUM 5.32026

  IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forgi…

• CVE-2022-50961 ↗MEDIUM 6.42026

  WordPress Plugin IP2Location Country Blocker 2.26.7 contains a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary JavaScript code through the Frontend Settin…

• ↗

• CVEs come from the US National Vulnerability Database (NVD) and are matched to IP2Location by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-09-17.
• Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-21.
• Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.