Login Request a demo
SM
Vendor
smub
22 products with CVEs on record
60
CVEs
0
On KEV
8
New 30D
Products
AI
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
smub
6.5
2 CVEs0 on KEV2 new
ED
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
smub
7.2
8 CVEs0 on KEV1 new
WA
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
smub
6.1
4 CVEs0 on KEV1 new
SB
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
smub
7.2
3 CVEs0 on KEV1 new
WM
WP Mail Logging
smub
7.5
2 CVEs0 on KEV1 new
DB
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
smub
8.8
1 CVEs0 on KEV1 new
WC
WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)
smub
7.2
1 CVEs0 on KEV1 new
CD
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
smub
6.5
5 CVEs0 on KEV0 new
EG
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
smub
6.4
5 CVEs0 on KEV0 new
PG
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
smub
8.8
5 CVEs0 on KEV0 new
AI
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic
smub
5.4
4 CVEs0 on KEV0 new
EG
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
smub
8.8
4 CVEs0 on KEV0 new
AA
aThemes Addons for Elementor
smub
6.4
3 CVEs0 on KEV0 new
SB
Smash Balloon Social Photo Feed – Easy Social Feeds Plugin
smub
5.4
3 CVEs0 on KEV0 new
CT
Custom Twitter Feeds – A Tweets Widget or X Feed Widget
smub
7.2
2 CVEs0 on KEV0 new
WE
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
smub
5.4
2 CVEs0 on KEV0 new
CD
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
smub
6.5
1 CVEs0 on KEV0 new
GA
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers
smub
7.2
1 CVEs0 on KEV0 new
PE
PDF Embedder – PDF Viewer & Embed PDF Files for WordPress
smub
4.3
1 CVEs0 on KEV0 new
SB
Slider by Soliloquy – Responsive Image Slider for WordPress
smub
4.3
1 CVEs0 on KEV0 new
UC
UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
smub
5.3
1 CVEs0 on KEV0 new
WI
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager
smub
8.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-82814
DB
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
smub
8.8
1%
Oct 21Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection
CVE-2026-109401
WM
WP Mail Logging
smub
2.7
0%
Oct 16WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email
CVE-2026-97640
WC
WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)
smub
7.2
0%
Oct 16WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)
CVE-2026-101921
WA
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
smub
4.7
0%
Oct 10WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute
CVE-2026-14335
ED
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
smub
7.2
0%
Oct 10Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters
CVE-2026-100152
AI
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
smub
6.5
0%
Oct 3All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter
CVE-2026-85492
AI
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
smub
6.1
0%
Oct 2All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname
CVE-2026-93756
SB
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
smub
7.2
0%
Oct 2Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview
CVE-2026-88996
WA
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
smub
6.1
0%
Sep 25WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter
CVE-2026-84909
CT
Custom Twitter Feeds – A Tweets Widget or X Feed Widget
smub
6.4
0%
Sep 18Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute
CVE-2026-77189
CD
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
smub
6.5
0%
Sep 1Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute
CVE-2026-3423
EG
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
smub
6.4
0%
Aug 28Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description
CVE-2026-16775
SB
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
smub
6.4
0%
Aug 16Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
CVE-2026-15452
SB
Smash Balloon Social Photo Feed – Easy Social Feeds Plugin
smub
4.7
0%
Aug 5Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String
CVE-2026-12476
ED
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
smub
7.2
1%
Jul 29Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter
CVE-2026-15782
WA
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
smub
4.9
0%
Jul 21WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content
CVE-2026-12002
SB
Smash Balloon Social Photo Feed – Easy Social Feeds Plugin
smub
4.7
0%
Jul 8Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter
CVE-2026-12127
WA
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
smub
5.3
1%
Jul 1WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name
CVE-2026-8613
AA
aThemes Addons for Elementor
smub
6.4
0%
Jun 10aThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Setting
CVE-2026-7792
WE
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
smub
5.3
0%
Jun 6WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint
CVE-2026-10038
CD
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
smub
4.3
0%
Jun 5Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter
CVE-2026-7526
PE
PDF Embedder – PDF Viewer & Embed PDF Files for WordPress
smub
4.3
0%
May 28PDF Embedder <= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Page
CVE-2026-7533
ED
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
smub
4.3
0%
May 28Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter
CVE-2026-8832
WI
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager
smub
8.8
2%
May 27WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost
CVE-2026-7636
SB
Slider by Soliloquy – Responsive Image Slider for WordPress
smub
4.3
0%
May 22Slider by Soliloquy <= 2.8.1 - Authenticated (Subscriber+) Information Disclosure via REST API Endpoint
CVE-2026-6566
PG
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
smub
4.3
0%
May 20Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API
CVE-2026-5075
AI
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic
smub
4.3
0%
May 20All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data
CVE-2026-5361
EG
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
smub
6.4
0%
May 14Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter
CVE-2026-6177
CT
Custom Twitter Feeds – A Tweets Widget or X Feed Widget
smub
7.2
0%
May 13Custom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Text
CVE-2026-7619
CD
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
smub
6.5
0%
May 13Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter
CVE-2026-5488
EG
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
smub
5.3
0%
Apr 24ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token'
CVE-2026-5464
EG
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
smub
7.2
1%
Apr 23ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process
CVE-2026-3177
CD
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
smub
5.3
0%
Apr 7Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook
CVE-2026-1463
PG
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
smub
8.8
0%
Mar 18Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion
CVE-2026-1992
EG
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
smub
8.8
1%
Mar 11ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation
CVE-2026-1993
EG
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
smub
8.8
0%
Mar 11ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update
CVE-2026-1236
EG
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
smub
6.4
0%
Mar 4Envira Gallery for WordPress <= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST API
CVE-2026-2471
WM
WP Mail Logging
smub
7.5
0%
Feb 28WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field
CVE-2025-14384
AI
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic
smub
4.3
0%
Jan 16All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure
CVE-2025-14783
ED
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
smub
4.3
0%
Dec 31Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect
CVE-2025-13641
PG
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
smub
8.8
1%
Dec 18Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'
CVE-2025-12484
GA
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers
smub
7.2
0%
Nov 19Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.19 - Unauthenticated Stored Cross-Site Scripting
CVE-2025-12847
AI
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic
smub
4.3
0%
Nov 15All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion
CVE-2025-12377
EG
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
smub
4.3
0%
Nov 13Gallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions
CVE-2025-11448
EG
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
smub
4.3
0%
Nov 8Gallery Plugin for WordPress – Envira Photo Gallery <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion
CVE-2025-12837
AA
aThemes Addons for Elementor
smub
6.4
0%
Nov 8aThemes Addons for Elementor <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget
CVE-2025-11271
ED
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
smub
5.3
0%
Nov 6Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation
CVE-2025-11893
CD
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
smub
6.5
0%
Oct 25Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection
CVE-2025-10694
UC
UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
smub
5.3
0%
Oct 25User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.8.0 - Missing Authorization to Information Disclosure
CVE-2025-8149
AA
aThemes Addons for Elementor
smub
6.4
0%
Sep 6aThemes Addons for Elementor Lite <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
CVE-2025-8102
ED
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
smub
5.4
0%
Aug 20Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions
CVE-2025-2537
PG
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
smub
6.4
0%
Jul 3Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library
CVE-2025-5275
CD
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
smub
4.0
0%
Jun 26Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings
CVE-2025-4577
SB
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
smub
5.4
0%
Jun 10Smash Balloon Custom Facebook Feed <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute
CVE-2025-4670
ED
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
smub
5.4
0%
May 29Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode
CVE-2025-4583
SB
Smash Balloon Social Photo Feed – Easy Social Feeds Plugin
smub
5.4
0%
May 29Smash Balloon Instagram Feed <= 6.9.0 (Free) & <= 6.8.0 (Pro) - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-plugin` Attribute
CVE-2024-5878
PG
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
smub
6.4
0%
May 20Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library
CVE-2025-2892
AI
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic
smub
5.4
0%
May 19All in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL
CVE-2025-3794
WE
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
smub
5.4
0%
May 9WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter
CVE-2024-12875
ED
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
smub
4.9
1%
Dec 21Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download