# cve.now: Smackcoders

The newest entries naming Smackcoders as an affected vendor (up to 200), of 35 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-45440](https://cve.now/CVE-2026-45440.md): WordPress WP Ultimate CSV Importer plugin \<= 9.2 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2026-103348](https://cve.now/CVE-2026-103348.md): WordPress WP Ultimate Exporter plugin \<= 3.0 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2026-103336](https://cve.now/CVE-2026-103336.md): WordPress WP Ultimate CSV Importer plugin \<= 9.1 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2026-13353](https://cve.now/CVE-2026-13353.md): WP Ultimate CSV Importer \<= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter (CVSS 8.8)
- [CVE-2026-1317](https://cve.now/CVE-2026-1317.md): WP Import – Ultimate CSV XML Importer for WordPress \<= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name (CVSS 6.5)
- [CVE-2025-14627](https://cve.now/CVE-2025-14627.md): WP Import – Ultimate CSV XML Importer for WordPress \<= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass (CVSS 6.4)
- [CVE-2025-13606](https://cve.now/CVE-2025-13606.md): Export All Posts, Products, Orders, Refunds & Users \<= 2.19 - Cross-Site Request Forgery to Sensitive Information Exposure (CVSS 6.5)
- [CVE-2025-13145](https://cve.now/CVE-2025-13145.md): WP Import – Ultimate CSV XML Importer for WordPress \<= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import (CVSS 7.2)
- [CVE-2025-12732](https://cve.now/CVE-2025-12732.md): WP Import – Ultimate CSV XML Importer for WordPress \<= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure (CVSS 4.3)
- [CVE-2025-10057](https://cve.now/CVE-2025-10057.md): WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection (CVSS 8.8)
- [CVE-2025-10058](https://cve.now/CVE-2025-10058.md): WP Import – Ultimate CSV XML Importer for WordPress \<= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1)
- [CVE-2025-10040](https://cve.now/CVE-2025-10040.md): WP Import – Ultimate CSV XML Importer for WordPress \<= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure (CVSS 7.7)
- [CVE-2025-9990](https://cve.now/CVE-2025-9990.md): WordPress Helpdesk Integration \<= 5.8.10 - Unauthenticated Local File Inclusion (CVSS 8.1)
- [CVE-2025-5692](https://cve.now/CVE-2025-5692.md): Lead Form Data Collection to CRM \<= 3.1 - Missing Authorization to Authenticated (Subscriber+) Many Actions (CVSS 6.3)
- [CVE-2025-47690](https://cve.now/CVE-2025-47690.md): WordPress Lead Form Data Collection to CRM plugin \<= 3.1 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2025-31788](https://cve.now/CVE-2025-31788.md): WordPress AIO Performance Profiler, Monitor, Optimize, Compress & Debug plugin \<= 1.3 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2025-31775](https://cve.now/CVE-2025-31775.md): WordPress Google SEO Pressor for Rich snippets Plugin \<= 2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-2008](https://cve.now/CVE-2025-2008.md): Import Export Suite for CSV and XML Datafeed \<= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2025-2007](https://cve.now/CVE-2025-2007.md): Import Export Suite for CSV and XML Datafeed \<= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1)
- [CVE-2025-31530](https://cve.now/CVE-2025-31530.md): WordPress Google SEO Pressor Snippet plugin \<= 2.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-22647](https://cve.now/CVE-2025-22647.md): WordPress AIO Performance Profiler plugin \<= 1.2 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-30810](https://cve.now/CVE-2025-30810.md): WordPress Lead Form Data Collection to CRM plugin \<= 3.0.1 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-2332](https://cve.now/CVE-2025-2332.md): Export All Posts, Products, Orders, Refunds & Users \<= 2.13 - Unauthenticated PHP Object Injection (CVSS 9.8)
- [CVE-2024-12315](https://cve.now/CVE-2024-12315.md): Export All Posts, Products, Orders, Refunds & Users \<= 2.9.3 - Information Disclosure Through Unprotected Directory (CVSS 7.5)
- [CVE-2025-24611](https://cve.now/CVE-2025-24611.md): WordPress Export All Posts, Products, Orders, Refunds & Users Plugin \<= 2.9 - Arbitrary File Read vulnerability (CVSS 4.9)
- [CVE-2025-23423](https://cve.now/CVE-2025-23423.md): WordPress SendGrid for WordPress plugin \<= 1.4 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-56278](https://cve.now/CVE-2024-56278.md): WordPress WP Ultimate Exporter plugin \<= 2.9.1 - Remote Code Execution (RCE) vulnerability (CVSS 9.1)
- [CVE-2024-9364](https://cve.now/CVE-2024-9364.md): SendGrid for WordPress \<= 1.4 - Missing Authorization to Authenticated (Subscriber+) Log Deletion (CVSS 4.3)
- [CVE-2024-43965](https://cve.now/CVE-2024-43965.md): WordPress SendGrid for WordPress plugin \<= 1.4 - SQL Injection vulnerability (CVSS 8.2)
- [CVE-2023-2487](https://cve.now/CVE-2023-2487.md): WordPress WP Ultimate Exporter Plugin \<= 2.4.1 is vulnerable to Sensitive Data Exposure (CVSS 5.9)
- [CVE-2023-45066](https://cve.now/CVE-2023-45066.md): WordPress WP Ultimate Exporter Plugin \<= 2.4.1 is vulnerable to Sensitive Data Exposure (CVSS 5.9)
- [CVE-2023-4142](https://cve.now/CVE-2023-4142.md): WP Ultimate CSV Importer \<= 7.9.8 - Authenticated (Author+) Remote Code Execution (CVSS 8.0)
- [CVE-2023-4141](https://cve.now/CVE-2023-4141.md): WP Ultimate CSV Importer \<= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution (CVSS 8.0)
- [CVE-2023-4139](https://cve.now/CVE-2023-4139.md): WP Ultimate CSV Importer \<= 7.9.8 - Sensitive Information Exposure via Directory Listing (CVSS 7.5)
- [CVE-2023-4140](https://cve.now/CVE-2023-4140.md): WP Ultimate CSV Importer \<= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation (CVSS 6.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/smackcoders
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.