Vulnerabilidades em roxnor
94 resultadosAnálise Vexday
Com 61 CVEs catalogadas e nenhuma entrada confirmada no catálogo KEV da CISA, o perfil de exploração ativa da Roxnor situa-se abaixo da média geral do catálogo. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão que tipicamente favorece ataques do lado do cliente e pode ser subestimado em triagens focadas apenas em severidade. A CVE mais relevante no momento é CVE-2023-0084, que apresenta o maior EPSS observado no portfólio (0,2857), indicando probabilidade não negligenciável de exploração mesmo sem confirmação ativa. A presença de uma PoC pública e três vulnerabilidades surgidas nos últimos 90 dias recomenda monitoramento contínuo, especialmente para equipes que dependem de patches recentes.
CVE-2026-57406MEDIUMWordPress FundEngine plugin <= 1.7.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-2791MEDIUMMetform Elementor Contact Form Builder <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via WidgetsEPSS 0.3%CVE-2025-14895MEDIUMPopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data DeletionEPSS 0.3%CVE-2025-3614MEDIUMElementsKit Elementor Addons and Templates <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom WidgetEPSS 0.3%CVE-2026-2879MEDIUMGetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/DeletionEPSS 0.3%CVE-2026-2600MEDIUMElementsKit Elementor Addons and Templates <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab WidgetEPSS 0.3%CVE-2024-32505MEDIUMWordPress ElementsKit Elementor addons plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-14059MEDIUMEmailKit <= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path TraversalEPSS 0.3%CVE-2026-104012HIGHRox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' EndpointEPSS 0.3%CVE-2026-100157MEDIUMWP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)EPSS 0.3%CVE-2026-1925MEDIUMEmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title ModificationEPSS 0.3%CVE-2026-24356MEDIUMWordPress GetGenie plugin <= 4.3.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-11180MEDIUMElementsKit Elementor addons <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-30914MEDIUMWordPress Metform Elementor Contact Form Builder plugin <= 3.9.7 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2026-85575MEDIUMThe ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' ParameterEPSS 0.3%CVE-2026-103519MEDIUMWP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' ParameterEPSS 0.3%CVE-2025-4479MEDIUMElementsKit Lite <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison WidgetEPSS 0.3%CVE-2026-65440HIGHWordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1003MEDIUMGetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools <= 4.3.0 - Missing Authorization to Authenticated (Author+) Arbitrary Post DeletionEPSS 0.2%CVE-2025-63057MEDIUMWordPress Wp Ultimate Review plugin <= 2.3.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%