Skip to contentSmub vulnerabilities
Products
- Easy Digital Downloads – Ecommerce Payments And Subscriptions Made Easy17
- Photo Gallery, Sliders, Proofing And Themes – Nextgen Gallery11
- Athemes Addons For Elementor8
- Charitable – Donation Plugin For Wordpress – Fundraising With Recurring Donations & More8
- All In One Seo – Powerful Seo Plugin To Boost Seo Rankings & Increase Traffic7
- Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More7
- Wpforms – Easy Form Builder For Wordpress – Contact Forms, Payment Forms, Surveys, & More6
- Custom Twitter Feeds – A Tweets Widget Or X Feed Widget5
- Sydney Toolbox5
- Exactmetrics – Google Analytics Dashboard For Wordpress (website Stats Plugin)4
- Wpforms – Ai Form Builder For Wordpress – Contact Forms, Payment Forms, Survey Form, Quiz & More4
- Wp Mail Logging4
- Feeds For Youtube (youtube Video, Channel, And Gallery Plugin)3
- Smash Balloon Social Photo Feed – Easy Social Feeds Plugin3
- Smash Balloon Social Post Feed – Simple Social Feeds For Wordpress3
- Userfeedback – Create Interactive Feedback Form, User Surveys, And Polls In Seconds3
- All In One Seo – Best Wordpress Seo Plugin – Easily Improve Seo Rankings & Increase Traffic2
- Contact Form & Smtp Plugin For Wordpress By Pirateforms2
- Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More2
- Easy Wp Smtp – Wordpress Smtp And Email Logs: Gmail, Office 365, Outlook, Custom Smtp, And More2
- Wordpress Gallery Plugin – Nextgen Gallery2
Newest
- smub envira gallery – image photo gallery, albums, video gallery, slideshows & moreGallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery ActionsCVE-2025-123774.3 Medium
- smub envira gallery – image photo gallery, albums, video gallery, slideshows & moreGallery Plugin for WordPress – Envira Photo Gallery <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery ConversionCVE-2025-114484.3 Medium
- smub athemes addons for elementoraThemes Addons for Elementor <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action WidgetCVE-2025-128376.4 Medium
- smub easy digital downloads – ecommerce payments and subscriptions made easyEasy Digital Download <= 3.5.2 - Insufficient Verification to Order ManipulationCVE-2025-112715.3 Medium
- smub charitable – donation plugin for wordpress – fundraising with recurring donations & moreCharitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL InjectionCVE-2025-118936.5 Medium
- smub userfeedback – create interactive feedback form, user surveys, and polls in secondsUser Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.8.0 - Missing Authorization to Information DisclosureCVE-2025-106945.3 Medium
- smub athemes addons for elementorWordPress aThemes Addons for Elementor Plugin <= 1.1.2 - Cross Site Scripting (XSS) VulnerabilityCVE-2025-601126.5 Medium
- smub athemes addons for elementoraThemes Addons for Elementor Lite <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetCVE-2025-81496.4 Medium
- smub easy digital downloads – ecommerce payments and subscriptions made easyEasy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install FunctionsCVE-2025-81025.4 Medium
- denis-de-bernardy auto thickbox, smub photo gallery, sliders, proofing and themes – nextgen gallery, wpdevart youtube embed, playlist and popup by wpdevart +2 moreMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript LibraryCVE-2025-25376.4 Medium
- smub charitable – donation plugin for wordpress – fundraising with recurring donations & more, wpbeginner charitable +1 moreCharitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy SettingsCVE-2025-52754.4 Medium
- smub smash balloon social post feed – simple social feeds for wordpress, wpbeginner smash balloon social post feed +1 moreSmash Balloon Custom Facebook Feed <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` AttributeCVE-2025-45776.4 Medium
- awesomemotive easy digital downloads, smub easy digital downloads – ecommerce payments and subscriptions made easy +1 moreEasy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt ShortcodeCVE-2025-46706.4 Medium
- smub smash balloon social photo feed – easy social feeds plugin, https://profiles.wordpress.org/smub/ smash balloon instagram feed pro +1 moreSmash Balloon Instagram Feed <= 6.9.0 (Free) & <= 6.8.0 (Pro) - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-plugin` AttributeCVE-2025-45835.4 Medium
- aknieriem simplelightbox, smub photo gallery, sliders, proofing and themes – nextgen gallery +1 moreMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript LibraryCVE-2024-58786.4 Medium
- aioseo all in one seo, smub all in one seo – powerful seo plugin to boost seo rankings & increase traffic +1 moreAll in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URLCVE-2025-28926.4 Medium
- smub wpforms – easy form builder for wordpress – contact forms, payment forms, surveys, & moreWPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' ParameterCVE-2025-37945.4 Medium
- athemes addons for elementor, smub athemes addons for elementor +1 moreWordPress aThemes Addons for Elementor plugin <= 1.1.3 - Local File Inclusion vulnerabilityCVE-2025-321587.5 High
- athemes addons for elementor, smub athemes addons for elementor +1 moreWordPress aThemes Addons for Elementor plugin <= 1.0.8 - Stored Cross Site Scripting (XSS) vulnerabilityCVE-2025-226466.5 Medium
- awesomemotive easy digital downloads, smub easy digital downloads – ecommerce payments and subscriptions made easy +1 moreEasy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title DisclosureCVE-2025-22525.3 Medium
- smub custom twitter feeds – a tweets widget or x feed widgetCustom Twitter Feeds <= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin FunctionCVE-2025-13144.3 Medium
- smub wpforms – easy form builder for wordpress – contact forms, payment forms, surveys, & more, wpforms +1 moreWPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML ParameterCVE-2024-134036.4 Medium
- athemes addons for elementor, smub athemes addons for elementor +1 moreaThemes Addons for Elementor <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-135476.4 Medium
- smub contact form & smtp plugin for wordpress by pirateformsContact Form & SMTP Plugin for WordPress by PirateForms <= 2.6.0 - Unauthenticated Arbitrary Shortcode ExecutionCVE-2024-134537.3 High
- awesomemotive easy digital downloads, smub easy digital downloads – ecommerce payments and subscriptions made easy +1 moreEasy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via TitleCVE-2024-135174.4 Medium
- awesomemotive easy digital downloads, smub easy digital downloads – ecommerce payments and subscriptions made easy +1 moreEasy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File DownloadCVE-2024-128754.9 Medium
- awesomemotive easy digital downloads, smub easy digital downloads – ecommerce payments and subscriptions made easy +1 moreEasy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall BypassCVE-2024-96543.7 Low
- wpforms, smub wpforms – easy form builder for wordpress – contact forms, payment forms, surveys, & more +1 moreWPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription CancellationCVE-2024-112058.5 High
- 10web form maker by 10web – mobile-friendly drag & drop contact form builder, bqworks accordion slider, colorlibplugins fancybox for wordpress +13 more +15 moreMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript LibraryCVE-2024-50206.4 Medium
- wpbeginner sugar calendar, smub sugar calendar – events calendar, event tickets, and events management platform +1 moreSugar Calendar (Lite) <= 3.3.0 - Reflected Cross-Site ScriptingCVE-2024-108786.1 Medium
- smub wpforms – easy form builder for wordpress – contact forms, payment forms, surveys, & more, wpforms +1 moreWPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log DeletionCVE-2024-105934.3 Medium
- athemes addons for elementor, smub athemes addons for elementor +1 moreWordPress aThemes Addons for Elementor plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-516756.5 Medium
- smub charitable – donation plugin for wordpress – fundraising with recurring donations & moreCharitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site ScriptingCVE-2024-108766.1 Medium
- smub transients managerTransients Manager <= 2.0.6 - Cross-Site Request ForgeryCVE-2024-100454.3 Medium
- awesomemotive easy digital downloads, smub easy digital downloads – ecommerce payments and subscriptions made easy +1 moreEasy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR DeserializationCVE-2022-24397.2 High
- wpcharitable charitable, smub charitable – donation plugin for wordpress – fundraising with recurring donations & more +1 moreDonation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege EscalationCVE-2024-87919.8 Critical
- smashballoon reviews feed, smub reviews feed – add testimonials and customer reviews from google reviews, yelp, tripadvisor, and more +1 moreReviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Settings UpdateCVE-2024-81994.3 Medium
- smashballoon reviews feed, smub reviews feed – add testimonials and customer reviews from google reviews, yelp, tripadvisor, and more +1 moreReviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More <= 1.1.2 - Cross-Site Request ForgeryCVE-2024-82004.3 Medium
- awesomemotive easy digital downloads, smub easy digital downloads – ecommerce payments and subscriptions made easy +1 moreEasy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement TextCVE-2024-66923.3 Low
- awesomemotive easy digital downloads, smub easy digital downloads – ecommerce payments and subscriptions made easy +1 moreEasy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency SettingsCVE-2024-66914.4 Medium
- athemes starter sites, smub athemes starter sites +1 moreaThemes Starter Sites <= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadCVE-2024-68976.4 Medium
- smub wp mail smtp by wpforms – the most popular smtp and email log pluginWP Mail SMTP <= 4.0.1 - Authenticated (Admin+) SMTP Password ExposureCVE-2024-66942.7 Low
- monsterinsights userfeedback, smub userfeedback – create interactive feedback form, user surveys, and polls in seconds +1 moreUserFeedback Lite <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Name ParameterCVE-2024-59027.2 High
- smashballoon feeds for youtube, smub feeds for youtube (youtube video, channel, and gallery plugin) +1 moreFeeds for YouTube (YouTube video, channel, and gallery plugin) <= 2.2.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingCVE-2024-62566.4 Medium
- snapcreek duplicator, smub duplicator – backups & migration plugin – cloud backups, scheduled backups, & more +1 moreDuplicator <= 1.5.9 - Full Path DisclosureCVE-2024-62105.3 Medium
- smub wp lightbox 2WP Lightbox 2 <= 3.0.6.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingCVE-2024-62636.4 Medium
- wp-ecommerce easy wp smtp, smub easy wp smtp – wordpress smtp and email logs: gmail, office 365, outlook, custom smtp, and more +1 moreEasy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UICVE-2024-30732.7 Low
- optinmonster, smub popup builder & popup maker for wordpress – optinmonster email marketing and lead generation +1 morePopup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation <= 2.16.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-40456.4 Medium
- athemes sydney toolboxSydney Toolbox <= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio WidgetCVE-2024-44736.4 Medium
- athemes sydney toolboxSydney Toolbox <= 1.30 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-40366.4 Medium
- Show moreLoading…