Vulnerabilidades em smub

114 resultados
Análise Vexday

O portfólio de vulnerabilidades do vendor smub soma 91 CVEs catalogadas, com nenhuma entrada confirmada no catálogo CISA KEV — taxa que se situa abaixo da média geral do catálogo, indicando ausência de exploração ativa confirmada publicamente até o momento. Ainda assim, a CVE mais perigosa identificada, CVE-2024-3097, apresenta escore EPSS de 0,3802, sugerindo probabilidade não negligenciável de exploração futura e merecendo monitoramento prioritário. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), e a existência de ao menos uma PoC pública eleva o risco prático para equipes que ainda não aplicaram as correções correspondentes. O volume de 15 CVEs surgidas nos últimos 90 dias indica cadência de descoberta recente relevante, recomendando revisão contínua do ciclo de patching para produtos desse vendor.

CVE-2024-9654LOWEasy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall BypassEPSS 0.4%CVE-2026-116563MEDIUMPhoto Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTMLEPSS 0.4%CVE-2024-6691MEDIUMEasy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency SettingsEPSS 0.4%CVE-2026-5361MEDIUMEnvira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' ParameterEPSS 0.4%CVE-2025-14783MEDIUMEasy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirectEPSS 0.3%CVE-2025-4577MEDIUMSmash Balloon Custom Facebook Feed <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` AttributeEPSS 0.3%CVE-2024-6263MEDIUMWP Lightbox 2 <= 3.0.6.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-12377MEDIUMGallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery ActionsEPSS 0.3%CVE-2024-2936MEDIUMSydney Toolbox <= 1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via _idEPSS 0.3%CVE-2024-6897MEDIUMaThemes Starter Sites <= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-3073LOWEasy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UIEPSS 0.3%CVE-2026-3423MEDIUMEnvira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery DescriptionEPSS 0.3%CVE-2026-16775MEDIUMSmash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode AttributeEPSS 0.3%CVE-2026-109401LOWWP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export EmailEPSS 0.3%CVE-2025-11271MEDIUMEasy Digital Download <= 3.5.2 - Insufficient Verification to Order ManipulationEPSS 0.3%CVE-2024-4045MEDIUMPopup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation <= 2.16.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-7792MEDIUMWPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook EndpointEPSS 0.3%CVE-2025-3794MEDIUMWPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' ParameterEPSS 0.3%CVE-2026-5488MEDIUMExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token'EPSS 0.3%CVE-2025-2892MEDIUMAll in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URLEPSS 0.3%