Smackcoders vulnerabilities
35 CVEs and advisories name Smackcoders as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-45440WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability
- CVE-2026-103348WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability
- CVE-2026-103336WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability
- CVE-2026-13353WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter
- CVE-2026-1317WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name
- CVE-2025-14627WP Import – Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass
- CVE-2025-13606Export All Posts, Products, Orders, Refunds & Users <= 2.19 - Cross-Site Request Forgery to Sensitive Information Exposure
- CVE-2025-13145WP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import
- CVE-2025-12732WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure
- CVE-2025-10057WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection
- CVE-2025-10058WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion
- CVE-2025-10040WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure
- CVE-2025-9990WordPress Helpdesk Integration <= 5.8.10 - Unauthenticated Local File Inclusion
- CVE-2025-5692Lead Form Data Collection to CRM <= 3.1 - Missing Authorization to Authenticated (Subscriber+) Many Actions
- CVE-2025-47690WordPress Lead Form Data Collection to CRM plugin <= 3.1 - Arbitrary Option Update to Privilege Escalation vulnerability
- CVE-2025-31788WordPress AIO Performance Profiler, Monitor, Optimize, Compress & Debug plugin <= 1.3 - Sensitive Data Exposure vulnerability
- CVE-2025-31775WordPress Google SEO Pressor for Rich snippets Plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2025-2008Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2025-2007Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion
- CVE-2025-31530WordPress Google SEO Pressor Snippet plugin <= 2.0 - Broken Access Control vulnerability
- CVE-2025-22647WordPress AIO Performance Profiler plugin <= 1.2 - Broken Access Control vulnerability
- CVE-2025-30810WordPress Lead Form Data Collection to CRM plugin <= 3.0.1 - SQL Injection vulnerability
- CVE-2025-2332Export All Posts, Products, Orders, Refunds & Users <= 2.13 - Unauthenticated PHP Object Injection
- CVE-2024-12315Export All Posts, Products, Orders, Refunds & Users <= 2.9.3 - Information Disclosure Through Unprotected Directory
- CVE-2025-24611WordPress Export All Posts, Products, Orders, Refunds & Users Plugin <= 2.9 - Arbitrary File Read vulnerability
- CVE-2025-23423WordPress SendGrid for WordPress plugin <= 1.4 - Broken Access Control vulnerability
- CVE-2024-56278WordPress WP Ultimate Exporter plugin <= 2.9.1 - Remote Code Execution (RCE) vulnerability
- CVE-2024-9364SendGrid for WordPress <= 1.4 - Missing Authorization to Authenticated (Subscriber+) Log Deletion
- CVE-2024-43965WordPress SendGrid for WordPress plugin <= 1.4 - SQL Injection vulnerability
- CVE-2023-2487WordPress WP Ultimate Exporter Plugin <= 2.4.1 is vulnerable to Sensitive Data Exposure