IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key

smub vulnerabilities (CVE)

CVE records published for smub, newest first. Follow to get an email when a new one appears.

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy 17Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery 10Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More 8Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More 7All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic 7WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More 6Sydney Toolbox 5WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More 4ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) 4aThemes Addons for Elementor 4Custom Twitter Feeds – A Tweets Widget or X Feed Widget 4Smash Balloon Social Post Feed – Simple Social Feeds for WordPress 3All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) 3Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers 3UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds 3WP Mail Logging 3Smash Balloon Social Photo Feed – Easy Social Feeds Plugin 3Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more 2Feeds for YouTube (YouTube video, channel, and gallery plugin) 2Contact Form & SMTP Plugin for WordPress by PirateForms 2Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More 2Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More 2Sugar Calendar – Events Calendar, Event Tickets, and Events Management Platform 1Transients Manager 1aThemes Starter Sites 1Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) 1PDF Embedder – PDF Viewer & Embed PDF Files for WordPress 1WP Lightbox 2 1Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation 1WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin 1WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager 1Slider by Soliloquy – Responsive Image Slider for WordPress 1WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) 1
114 results
8.1High
CVE-2026-120538

Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture

smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field…

8.8High
CVE-2026-76010

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal

smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supp…

5.3Medium
CVE-2026-109367

All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter

smub All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.0.3 via the 's' parameter. This makes i…

5.4Medium
CVE-2026-116563

Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML

smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.5.4 due to insufficient input sanitization and ou…

7.5High
CVE-2026-76012

Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload

smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacy_render function. This is due to broken authorization on the Lightroom gall…

8.8High
CVE-2026-82814

Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection

smub Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More; Duplicator Duplicator Pro

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() dur…

7.2High
CVE-2026-97640

WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)

smub WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)

The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in …

4.7Medium
CVE-2026-101921

WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute

smub WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag (e.g. "x")' parameter in all ver…

6.5Medium
CVE-2026-100152

All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter

smub All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allo…

6.1Medium
CVE-2026-85492

All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname

smub All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insuffici…

7.2High
CVE-2026-93756

Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview

smub Smash Balloon Social Post Feed – Simple Social Feeds for WordPress

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insuf…

6.1Medium
CVE-2026-88996

WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter

smub WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'page_title' POST Parameter via {page_title} Smart Tag in all versions up to, and inc…

6.5Medium
CVE-2026-77189

Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute

smub Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)

The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to in…

6.4Medium
CVE-2026-16775

Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

smub Smash Balloon Social Post Feed – Simple Social Feeds for WordPress

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output…

7.2High
CVE-2026-12476

Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter

smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edd_do_ajax_import_file_upload() function , which only checks the client-supp…

1.2%EPSS
4.9Medium
CVE-2026-15782

WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content

smub WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content in all versions up to, a…

4.7Medium
CVE-2026-12002

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter

smub Smash Balloon Social Photo Feed – Easy Social Feeds Plugin

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybe_connection_data fun…

5.3Medium
CVE-2026-12127

WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name

smub WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') in all versions up to, and including, 1.10.2 This is due to `get_r…

5.3Medium
CVE-2026-7792

WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint

smub WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to and including 1.10.0.1. This is due to the PayPal Commerce web…