Vulnerabilities in realmag777

120 results
Vexday analysis

Com 84 CVEs catalogadas e nenhuma em exploração ativa confirmada pelo CISA KEV, o perfil do vendor realmag777 apresenta taxa de exploração abaixo da média geral do catálogo. Ainda assim, a CVE mais perigosa identificada, CVE-2025-1661, registra EPSS de 0,5281 — indicando probabilidade relevante de exploração futura —, e existe ao menos uma prova de conceito pública circulando, o que eleva o risco prático para ambientes que ainda não aplicaram correções. O tipo de falha mais recorrente é CWE-352 (Cross-Site Request Forgery), padrão que sugere controles de autenticação de requisição inconsistentes nas implementações. O surgimento de 5 novas CVEs nos últimos 90 dias, somado a 6 vulnerabilidades de severidade crítica no histórico total, recomenda monitoramento contínuo e priorização de patches para quem opera plugins ou componentes desse vendor.

CVE-2023-4924MEDIUMBEAR <= 1.1.3.3 - Missing Authorization to Product DeletionEPSS 0.3%CVE-2026-4094HIGHFOX – Currency Switcher Professional for WooCommerce <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Configuration DeletionEPSS 0.3%CVE-2023-46152MEDIUMWordPress WOLF Plugin <= 1.0.7.1 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2026-3513MEDIUMTableOn – WordPress Posts Table Filterable <= 1.0.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode AttributeEPSS 0.3%CVE-2023-34028MEDIUMWordPress WOLF Plugin <= 1.0.7 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2023-49834MEDIUMWordPress WOOCS – WooCommerce Currency Switcher Plugin <= 1.4.1.4 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2024-50451MEDIUMWordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-0796MEDIUMActive Products Tables for WooCommerce. Professional products tables for WooCommerce store <= 1.0.6.1 - Cross-Site Request ForgeryEPSS 0.2%CVE-2025-3748MEDIUMTaxonomy Chain Menu <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via pn_chain_menu ShortcodeEPSS 0.2%CVE-2024-30462MEDIUMWordPress HUSKY plugin <= 1.3.5.1 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2024-30457MEDIUMWordPress MDTF plugin <= 1.3.3.1 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2024-30458MEDIUMWordPress FOX – Currency Switcher Professional for WooCommerce plugin <= 1.4.1.7 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2024-30456MEDIUMWordPress WPCS – WordPress Currency Switcher Professional plugin <=1.2.0.1 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2025-26775MEDIUMWordPress BEAR Plugin <= 1.1.4.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-13109MEDIUMHUSKY – Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query'EPSS 0.2%CVE-2026-42755CRITICALWordPress TableOn plugin <= 1.0.5.1 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-39574CRITICALWordPress InPost Gallery plugin <= 2.1.4.6 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-57319HIGHWordPress FOX plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-42761CRITICALWordPress Active Products Tables for WooCommerce plugin <= 1.0.9 - SQL Injection vulnerabilityEPSS 0.2%CVE-2023-50861MEDIUMWordPress HUSKY plugin <= 1.3.4.3 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%