Vulnerabilidades em smub

114 resultados
Análise Vexday

O portfólio de vulnerabilidades do vendor smub soma 91 CVEs catalogadas, com nenhuma entrada confirmada no catálogo CISA KEV — taxa que se situa abaixo da média geral do catálogo, indicando ausência de exploração ativa confirmada publicamente até o momento. Ainda assim, a CVE mais perigosa identificada, CVE-2024-3097, apresenta escore EPSS de 0,3802, sugerindo probabilidade não negligenciável de exploração futura e merecendo monitoramento prioritário. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), e a existência de ao menos uma PoC pública eleva o risco prático para equipes que ainda não aplicaram as correções correspondentes. O volume de 15 CVEs surgidas nos últimos 90 dias indica cadência de descoberta recente relevante, recomendando revisão contínua do ciclo de patching para produtos desse vendor.

CVE-2019-25145HIGHContact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injectionEPSS 0.7%CVE-2023-3081HIGHWP Mail Logging <= 1.11.1 - Unauthenticated Stored Cross-Site Scripting via EmailEPSS 0.6%CVE-2024-2302MEDIUMEasy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information ExposureEPSS 0.6%CVE-2024-4036MEDIUMSydney Toolbox <= 1.30 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2026-12127MEDIUMWPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display NameEPSS 0.6%CVE-2024-6210MEDIUMDuplicator <= 1.5.9 - Full Path DisclosureEPSS 0.6%CVE-2024-6694LOWWP Mail SMTP <= 4.0.1 - Authenticated (Admin+) SMTP Password ExposureEPSS 0.6%CVE-2024-13453HIGHContact Form & SMTP Plugin for WordPress by PirateForms <= 2.6.0 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.6%CVE-2023-5049MEDIUMGiveaways and Contests by RafflePress <= 1.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2023-4841MEDIUMFeeds for YouTube <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2026-6177HIGHCustom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet TextEPSS 0.5%CVE-2024-10878MEDIUMSugar Calendar (Lite) <= 3.3.0 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2026-1463HIGHPhoto Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File InclusionEPSS 0.5%CVE-2026-77189MEDIUMCharitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode AttributeEPSS 0.5%CVE-2026-2471HIGHWP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message FieldEPSS 0.5%CVE-2024-3554MEDIUMAll in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-0903MEDIUMUser Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.0.13 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-5020MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript LibraryEPSS 0.4%CVE-2026-1993HIGHExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings UpdateEPSS 0.4%CVE-2026-120538HIGHEasy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal CaptureEPSS 0.4%