Vulnerabilidades em realmag777

121 resultados
Análise Vexday

Com 84 CVEs catalogadas e nenhuma em exploração ativa confirmada pelo CISA KEV, o perfil do vendor realmag777 apresenta taxa de exploração abaixo da média geral do catálogo. Ainda assim, a CVE mais perigosa identificada, CVE-2025-1661, registra EPSS de 0,5281 — indicando probabilidade relevante de exploração futura —, e existe ao menos uma prova de conceito pública circulando, o que eleva o risco prático para ambientes que ainda não aplicaram correções. O tipo de falha mais recorrente é CWE-352 (Cross-Site Request Forgery), padrão que sugere controles de autenticação de requisição inconsistentes nas implementações. O surgimento de 5 novas CVEs nos últimos 90 dias, somado a 6 vulnerabilidades de severidade crítica no histórico total, recomenda monitoramento contínuo e priorização de patches para quem opera plugins ou componentes desse vendor.

CVE-2025-1661CRITICALHUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File InclusionEPSS 56.1%CVE-2024-6457CRITICALHUSKY - Products Filter Professional for WooCommerce <= 1.3.6 - Unauthenticated Time-Based SQL InjectionEPSS 19.7%CVE-2024-50450HIGHWordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Bypass Vulnerability vulnerabilityEPSS 1.2%CVE-2024-3734MEDIUMFOX – Currency Switcher Professional for WooCommerce <= 1.4.1.8 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 1.0%CVE-2021-20780—Cross-site request forgery (CSRF) vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote attackers to hijack thEPSS 0.9%CVE-2021-20781—Cross-site request forgery (CSRF) vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions priEPSS 0.8%CVE-2025-32569CRITICALWordPress TableOn plugin <= 1.0.4.3 - PHP Object Injection vulnerabilityEPSS 0.8%CVE-2024-3061HIGHHUSKY – Products Filter Professional for WooCommerce <= 1.3.5.2 - Authenticated (Admin+) Local File InclusionEPSS 0.8%CVE-2024-8271HIGHFOX – Currency Switcher Professional for WooCommerce <= 1.4.2.1 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.7%CVE-2025-24605HIGHWordPress WOLF plugin <= 1.0.8.5 - Path Traversal vulnerabilityEPSS 0.7%CVE-2023-51505CRITICALWordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to PHP Object InjectionEPSS 0.7%CVE-2024-8623HIGHMDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.6%CVE-2024-52396MEDIUMWordPress WOLF plugin <= 1.0.8.3 - CSV Limited Path Traversal vulnerabilityEPSS 0.6%CVE-2023-40010CRITICALWordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin <= 1.3.4.2 is vulnerable to SQL InjectionEPSS 0.6%CVE-2025-26890HIGHWordPress HUSKY plugin <= 1.3.6.4 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2025-52708HIGHWordPress HUSKY plugin <= 1.3.7 - Local File Inclusion VulnerabilityEPSS 0.6%CVE-2024-11002MEDIUMInPost Gallery <= 2.1.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via inpost_gallery_get_shortcode_templateEPSS 0.6%CVE-2024-1795HIGHHUSKY – Products Filter for WooCommerce Professional <= 1.3.5.2 - Authenticated (Contributor+) SQL InjectionEPSS 0.6%CVE-2024-10959HIGHActive Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.5 - Unauthenticated Arbitrary Shortcode Execution via woot_get_smthEPSS 0.6%CVE-2025-2169HIGHWPCS – WordPress Currency Switcher Professional <= 1.2.0.4 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.5%