Smub vulnerabilities

Products

• Easy Digital Downloads – Ecommerce Payments And Subscriptions Made Easy 17
• Photo Gallery, Sliders, Proofing And Themes – Nextgen Gallery 10
• Athemes Addons For Elementor 8
• Charitable – Donation Plugin For Wordpress – Fundraising With Recurring Donations & More 8
• All In One Seo – Powerful Seo Plugin To Boost Seo Rankings & Increase Traffic 7
• Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More 7
• Wpforms – Easy Form Builder For Wordpress – Contact Forms, Payment Forms, Surveys, & More 6
• Custom Twitter Feeds – A Tweets Widget Or X Feed Widget 5
• Sydney Toolbox 5
• Exactmetrics – Google Analytics Dashboard For Wordpress (website Stats Plugin) 4
• Wpforms – Ai Form Builder For Wordpress – Contact Forms, Payment Forms, Survey Form, Quiz & More 4
• Wp Mail Logging 4
• Feeds For Youtube (youtube Video, Channel, And Gallery Plugin) 3
• Smash Balloon Social Photo Feed – Easy Social Feeds Plugin 3
• Smash Balloon Social Post Feed – Simple Social Feeds For Wordpress 3
• Userfeedback – Create Interactive Feedback Form, User Surveys, And Polls In Seconds 3
• All In One Seo – Best Wordpress Seo Plugin – Easily Improve Seo Rankings & Increase Traffic 2
• Contact Form & Smtp Plugin For Wordpress By Pirateforms 2
• Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More 2
• Easy Wp Smtp – Wordpress Smtp And Email Logs: Gmail, Office 365, Outlook, Custom Smtp, And More 2
• Wordpress Gallery Plugin – Nextgen Gallery 2

Newest

• smub easy digital downloads – ecommerce payments and subscriptions made easy Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture CVE-2026-120538 8.1 HighNovember 3, 2026
• smub photo gallery, sliders, proofing and themes – nextgen gallery Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal CVE-2026-76010 8.8 HighOctober 31, 2026
• smub all in one seo – ai seo plugin to boost seo rankings & traffic (schema, local seo, sitemap & seo insights) All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter CVE-2026-109367 5.3 MediumOctober 31, 2026
• smub photo gallery, sliders, proofing and themes – nextgen gallery Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML CVE-2026-116563 5.4 MediumOctober 31, 2026
• smub photo gallery, sliders, proofing and themes – nextgen gallery Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload CVE-2026-76012 7.5 HighOctober 30, 2026
• duplicator pro, unknown duplicator pro, smub duplicator – backups & migration plugin – cloud backups, scheduled backups, & more +2 more Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection CVE-2026-82814 8.8 HighOctober 21, 2026
• smub wpconsent – cookie banner & cookie consent for privacy compliance (gdpr / ccpa / eu compliance cookie notice) WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) CVE-2026-97640 7.2 HighOctober 16, 2026
• smub wp mail logging WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email CVE-2026-109401 2.7 LowOctober 16, 2026
• smub wpforms – ai form builder for wordpress – contact forms, payment forms, survey form, quiz & more WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute CVE-2026-101921 4.7 MediumOctober 10, 2026
• smub easy digital downloads – ecommerce payments and subscriptions made easy Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters CVE-2026-14335 7.2 HighOctober 10, 2026
• smub all in one seo – ai seo plugin to boost seo rankings & traffic (schema, local seo, sitemap & seo insights) All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter CVE-2026-100152 6.5 MediumOctober 3, 2026
• smub all in one seo – ai seo plugin to boost seo rankings & traffic (schema, local seo, sitemap & seo insights) All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname CVE-2026-85492 6.1 MediumOctober 2, 2026
• smub smash balloon social post feed – simple social feeds for wordpress Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview CVE-2026-93756 7.2 HighOctober 2, 2026
• smub wp mail logging WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection CVE-2026-1661 4.3 MediumOctober 2, 2026
• smub wpforms – ai form builder for wordpress – contact forms, payment forms, survey form, quiz & more WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter CVE-2026-88996 Public exploit 6.1 MediumSeptember 25, 2026
• smub custom twitter feeds – a tweets widget or x feed widget Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute CVE-2026-84909 6.4 MediumSeptember 18, 2026
• smub charitable – donation & fundraising platform (donation forms, recurring donations & fundraising campaigns) Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute CVE-2026-77189 6.5 MediumSeptember 1, 2026
• smub envira gallery – image photo gallery, albums, video gallery, slideshows & more Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description CVE-2026-3423 6.4 MediumAugust 28, 2026
• smub smash balloon social post feed – simple social feeds for wordpress Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute CVE-2026-16775 6.4 MediumAugust 16, 2026
• smub smash balloon social photo feed – easy social feeds plugin Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String CVE-2026-15452 4.7 MediumAugust 5, 2026
• smub easy digital downloads – ecommerce payments and subscriptions made easy Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter CVE-2026-12476 7.2 HighJuly 29, 2026
• smub wpforms – ai form builder for wordpress – contact forms, payment forms, survey form, quiz & more WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content CVE-2026-15782 4.9 MediumJuly 21, 2026
• smub smash balloon social photo feed – easy social feeds plugin Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter CVE-2026-12002 4.7 MediumJuly 8, 2026
• smub wpforms – ai form builder for wordpress – contact forms, payment forms, survey form, quiz & more WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name CVE-2026-12127 5.3 MediumJuly 1, 2026
• smub athemes addons for elementor aThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Setting CVE-2026-8613 6.4 MediumJune 10, 2026
• smub wpforms – easy form builder for wordpress – contact forms, payment forms, surveys, & more WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint CVE-2026-7792 5.3 MediumJune 6, 2026
• smub charitable – donation plugin for wordpress – fundraising with recurring donations & more Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter CVE-2026-10038 4.3 MediumJune 5, 2026
• smub pdf embedder – pdf viewer & embed pdf files for wordpress PDF Embedder <= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Page CVE-2026-7526 4.3 MediumMay 28, 2026
• smub easy digital downloads – ecommerce payments and subscriptions made easy Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter CVE-2026-7533 4.3 MediumMay 28, 2026
• smub wpcode – insert headers and footers + custom code snippets – wordpress code manager WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost CVE-2026-8832 Public exploit 8.8 HighMay 27, 2026
• smub slider by soliloquy – responsive image slider for wordpress Slider by Soliloquy <= 2.8.1 - Authenticated (Subscriber+) Information Disclosure via REST API Endpoint CVE-2026-7636 4.3 MediumMay 22, 2026
• smub photo gallery, sliders, proofing and themes – nextgen gallery Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API CVE-2026-6566 4.3 MediumMay 20, 2026
• smub all in one seo – powerful seo plugin to boost seo rankings & increase traffic All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data CVE-2026-5075 4.3 MediumMay 20, 2026
• smub feeds for youtube (youtube video, channel, and gallery plugin) Feeds for YouTube < 2.6.4 - Subscriber+ License Data Deletion CVE-2026-1631 5.4 MediumMay 18, 2026
• smub envira gallery – image photo gallery, albums, video gallery, slideshows & more Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter CVE-2026-5361 6.4 MediumMay 14, 2026
• smub custom twitter feeds – a tweets widget or x feed widget Custom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Text CVE-2026-6177 7.2 HighMay 13, 2026
• smub charitable – donation plugin for wordpress – fundraising with recurring donations & more Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter CVE-2026-7619 6.5 MediumMay 13, 2026
• smub exactmetrics – google analytics dashboard for wordpress (website stats plugin) ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token' CVE-2026-5488 5.3 MediumApril 24, 2026
• smub exactmetrics – google analytics dashboard for wordpress (website stats plugin) ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process CVE-2026-5464 7.2 HighApril 23, 2026
• smub charitable – donation plugin for wordpress – fundraising with recurring donations & more Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stri… CVE-2026-3177 5.3 MediumApril 7, 2026
• smub photo gallery, sliders, proofing and themes – nextgen gallery Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion CVE-2026-1463 8.8 HighMarch 18, 2026
• smub exactmetrics – google analytics dashboard for wordpress (website stats plugin) ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation CVE-2026-1992 8.8 HighMarch 11, 2026
• smub exactmetrics – google analytics dashboard for wordpress (website stats plugin) ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update CVE-2026-1993 8.8 HighMarch 11, 2026
• smub envira gallery – image photo gallery, albums, video gallery, slideshows & more Envira Gallery for WordPress <= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST API CVE-2026-1236 6.4 MediumMarch 4, 2026
• smub wp mail logging WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field CVE-2026-2471 7.5 HighFebruary 28, 2026
• smub all in one seo – powerful seo plugin to boost seo rankings & increase traffic All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure CVE-2025-14384 4.3 MediumJanuary 16, 2026
• smub easy digital downloads – ecommerce payments and subscriptions made easy Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect CVE-2025-14783 Public exploit 4.3 MediumDecember 31, 2025
• smub photo gallery, sliders, proofing and themes – nextgen gallery Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template' CVE-2025-13641 8.8 HighDecember 18, 2025
• smub giveaways and contests by rafflepress – get more website traffic, email subscribers, and social followers Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.19 - Unauthenticated Stored Cross-Site Scripting CVE-2025-12484 7.2 HighNovember 19, 2025
• smub all in one seo – powerful seo plugin to boost seo rankings & increase traffic All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion CVE-2025-12847 4.3 MediumNovember 15, 2025
• Show olderLoading…