Vulnerabilities in metagauss

116 results
Vexday analysis

Com 54 CVEs catalogadas e nenhuma registrada no CISA KEV, a taxa de exploração ativa da Metagauss está abaixo da média geral do catálogo, o que sugere pressão ofensiva relativamente menor no momento. Ainda assim, 4 vulnerabilidades são classificadas como críticas e o tipo de falha mais recorrente — CWE-862 (Missing Authorization) — indica problemas estruturais de controle de acesso que podem facilitar escalonamento de privilégios ou acesso indevido a recursos protegidos. A CVE mais perigosa atualmente identificada é CVE-2024-10508, com escore EPSS de 0,0146, e a existência de ao menos uma PoC pública no conjunto reforça a necessidade de atenção na priorização de patches. As 4 CVEs surgidas nos últimos 90 dias indicam atividade contínua de descoberta, exigindo monitoramento próximo do ciclo de divulgação.

CVE-2024-12024HIGHEventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type NameEPSS 0.4%CVE-2024-9829MEDIUMDownload Plugin <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment DownloadEPSS 0.4%CVE-2024-1123MEDIUMEventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post OverwriteEPSS 0.4%CVE-2025-11204HIGHRegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL InjectionEPSS 0.4%CVE-2024-25935MEDIUMWordPress RegistrationMagic plugin <= 5.2.5.9 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-32498HIGHWordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-1657MEDIUMEventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX EndpointEPSS 0.4%CVE-2026-82225HIGHWordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerabilityEPSS 0.4%CVE-2025-47478HIGHWordPress ProfileGrid plugin <= 5.9.5.0 - SQL Injection VulnerabilityEPSS 0.4%CVE-2026-4607MEDIUMProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings ModificationEPSS 0.4%CVE-2025-0723MEDIUMProfileGrid – User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL InjectionEPSS 0.4%CVE-2024-31291MEDIUMWordPress ProfileGrid plugin <= 5.7.6 - IDOR on Friend Request vulnerabilityEPSS 0.4%CVE-2026-4609HIGHProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group JoiningEPSS 0.4%CVE-2026-24373HIGHWordPress RegistrationMagic plugin <= 6.0.7.1 - Account Takeover vulnerabilityEPSS 0.4%CVE-2023-51543MEDIUMWordPress RegistrationMagic plugin <= 5.2.5.0 - IP Limit Bypass vulnerabilityEPSS 0.4%CVE-2024-1320MEDIUMEventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-9865MEDIUMEventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction LogEPSS 0.4%CVE-2024-13741MEDIUMProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request ForgeryEPSS 0.4%CVE-2023-23989MEDIUMWordPress RegistrationMagic plugin <= 5.1.9.2 - Content InjectionEPSS 0.4%CVE-2025-25110MEDIUMWordPress Event Kikfyre plugin <= 2.1.8 - Broken Access Control vulnerabilityEPSS 0.4%