Vulnerabilidades en Cozmoslabs
62 resultadosAnálisis Vexday
Cozmoslabs apresenta 25 CVEs catalogadas, sendo 2 críticas, com 5 publicadas nos últimos 90 dias indicando atividade contínua de descoberta de falhas. Nenhuma vulnerabilidade está sob exploração ativa conhecida (KEV), reduzindo o risco imediato. A fraqueza dominante é CWE-352 (Cross-Site Request Forgery), típica de aplicações web, sugerindo necessidade de revisão de controles anti-CSRF nos produtos.
CVE-2024-10261HIGHPaid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.0 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.5%CVE-2025-66073HIGHWordPress WP Webhooks plugin <= 3.3.8 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2026-6431HIGHUser Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta FieldEPSS 0.4%CVE-2024-5639MEDIUMUser Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture UpdateEPSS 0.4%CVE-2026-27413CRITICALWordPress Profile Builder Pro plugin < 3.14.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-18510HIGHTranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.4%CVE-2026-75981HIGHTranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-12738MEDIUMUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-9222MEDIUMPaid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.12.8 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-75964MEDIUMUser Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' ParameterEPSS 0.4%CVE-2025-58592HIGHWordPress TranslatePress Plugin <= 2.10.2 - Deserialization of untrusted data VulnerabilityEPSS 0.4%CVE-2025-68514MEDIUMWordPress Paid Member Subscriptions plugin <= 2.16.8 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.4%CVE-2025-58600MEDIUMWordPress Paid Member Subscriptions Plugin <= 2.15.9 - Broken Access Control VulnerabilityEPSS 0.4%CVE-2026-59539HIGHWordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2023-6504MEDIUMProfile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta ShortcodeEPSS 0.3%CVE-2024-22142HIGHWordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-75965MEDIUMUser Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode AttributeEPSS 0.3%CVE-2026-61971LOWWordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2026-18512MEDIUMTranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation EditorEPSS 0.3%CVE-2025-2314MEDIUMUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%