Vulnerabilities in roxnor
88 resultsVexday analysis
Com 61 CVEs catalogadas e nenhuma entrada confirmada no catálogo KEV da CISA, o perfil de exploração ativa da Roxnor situa-se abaixo da média geral do catálogo. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão que tipicamente favorece ataques do lado do cliente e pode ser subestimado em triagens focadas apenas em severidade. A CVE mais relevante no momento é CVE-2023-0084, que apresenta o maior EPSS observado no portfólio (0,2857), indicando probabilidade não negligenciável de exploração mesmo sem confirmação ativa. A presença de uma PoC pública e três vulnerabilidades surgidas nos últimos 90 dias recomenda monitoramento contínuo, especialmente para equipes que dependem de patches recentes.
CVE-2024-32505MEDIUMWordPress ElementsKit Elementor addons plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-14059MEDIUMEmailKit <= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path TraversalEPSS 0.3%CVE-2026-2879MEDIUMGetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/DeletionEPSS 0.3%CVE-2026-24356MEDIUMWordPress GetGenie plugin <= 4.3.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-11180MEDIUMElementsKit Elementor addons <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-1925MEDIUMEmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title ModificationEPSS 0.3%CVE-2025-30914MEDIUMWordPress Metform Elementor Contact Form Builder plugin <= 3.9.7 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2025-3614MEDIUMElementsKit Elementor Addons and Templates <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom WidgetEPSS 0.3%CVE-2025-4479MEDIUMElementsKit Lite <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison WidgetEPSS 0.2%CVE-2025-63057MEDIUMWordPress Wp Ultimate Review plugin <= 2.3.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-1003MEDIUMGetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools <= 4.3.0 - Missing Authorization to Authenticated (Author+) Arbitrary Post DeletionEPSS 0.2%CVE-2025-14441MEDIUMPopupkit <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Subscriber Data DeletionEPSS 0.2%CVE-2026-2257MEDIUMGetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST APIEPSS 0.2%CVE-2023-6788MEDIUMMetform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request ForgeryEPSS 0.2%CVE-2026-75930MEDIUMFundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' ParameterEPSS 0.2%CVE-2025-10173LOWShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.3 - Insufficient Authorization to Authenticated (Editor+) Settings UpdateEPSS 0.2%CVE-2026-18100MEDIUMMetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget SettingEPSS 0.2%CVE-2025-69026MEDIUMWordPress PopupKit plugin <= 2.1.5 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-0633LOWMetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie ValueEPSS 0.2%CVE-2025-11888LOWShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status UpdateEPSS 0.2%