# cve.now: Smub

The newest entries naming Smub as an affected vendor (up to 200), of 114 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120538](https://cve.now/CVE-2026-120538.md): Easy Digital Downloads \<= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding… (CVSS 8.1)
- [CVE-2026-76010](https://cve.now/CVE-2026-76010.md): Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery \<= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC… (CVSS 8.8)
- [CVE-2026-109367](https://cve.now/CVE-2026-109367.md): All in One SEO \<= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter (CVSS 5.3)
- [CVE-2026-116563](https://cve.now/CVE-2026-116563.md): Photo Gallery, Sliders, Proofing and Themes \<= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment \`title\` Attribute… (CVSS 5.4)
- [CVE-2026-76012](https://cve.now/CVE-2026-76012.md): Photo Gallery, Sliders, Proofing and Themes \<= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery\_edit' Task… (CVSS 7.5)
- [CVE-2026-82814](https://cve.now/CVE-2026-82814.md): Duplicator \<= 1.5.17 and Duplicator Pro \<= 4.6.10 - Unauthenticated PHP Object Injection (CVSS 8.8)
- [CVE-2026-109401](https://cve.now/CVE-2026-109401.md): WP Mail Logging \<= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email (CVSS 2.7)
- [CVE-2026-97640](https://cve.now/CVE-2026-97640.md): WPConsent \<= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) (CVSS 7.2)
- [CVE-2026-101921](https://cve.now/CVE-2026-101921.md): WPForms \<= 2.0.2.1 - Reflected Cross-Site Scripting via 'query\_var' Smart Tag in iframe srcdoc Attribute (CVSS 4.7)
- [CVE-2026-14335](https://cve.now/CVE-2026-14335.md): Easy Digital Downloads \<= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters (CVSS 7.2)
- [CVE-2026-100152](https://cve.now/CVE-2026-100152.md): All in One SEO \<= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter (CVSS 6.5)
- [CVE-2026-85492](https://cve.now/CVE-2026-85492.md): All in One SEO \<= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname (CVSS 6.1)
- [CVE-2026-93756](https://cve.now/CVE-2026-93756.md): Smash Balloon Social Post Feed \<= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview (CVSS 7.2)
- [CVE-2026-88996](https://cve.now/CVE-2026-88996.md): WPForms \<= 2.0.2 - Reflected Cross-Site Scripting via 'page\_title' POST Parameter (CVSS 6.1)
- [CVE-2026-84909](https://cve.now/CVE-2026-84909.md): Custom Twitter Feeds \<= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-77189](https://cve.now/CVE-2026-77189.md): Charitable \<= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute (CVSS 6.5)
- [CVE-2026-3423](https://cve.now/CVE-2026-3423.md): Envira Gallery \<= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description (CVSS 6.4)
- [CVE-2026-16775](https://cve.now/CVE-2026-16775.md): Smash Balloon Social Post Feed \<= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-15452](https://cve.now/CVE-2026-15452.md): Smash Balloon Social Photo Feed \<= 6.11.3 - Reflected Cross-Site Scripting via REQUEST\_URI Query String (CVSS 4.7)
- [CVE-2026-12476](https://cve.now/CVE-2026-12476.md): Easy Digital Downloads \<= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter (CVSS 7.2)
- [CVE-2026-15782](https://cve.now/CVE-2026-15782.md): WPForms \<= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content (CVSS 4.9)
- [CVE-2026-12002](https://cve.now/CVE-2026-12002.md): Smash Balloon Social Photo Feed – Easy Social Feeds Plugin \<= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi\_access\_token' Parameter (CVSS 4.7)
- [CVE-2026-12127](https://cve.now/CVE-2026-12127.md): WPForms \<= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name (CVSS 5.3)
- [CVE-2026-8613](https://cve.now/CVE-2026-8613.md): aThemes Addons for Elementor \<= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title\_tag' Widget Setting (CVSS 6.4)
- [CVE-2026-7792](https://cve.now/CVE-2026-7792.md): WPForms \<= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint (CVSS 5.3)
- [CVE-2026-10038](https://cve.now/CVE-2026-10038.md): Charitable \<= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter (CVSS 4.3)
- [CVE-2026-7526](https://cve.now/CVE-2026-7526.md): PDF Embedder \<= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Page (CVSS 4.3)
- [CVE-2026-7533](https://cve.now/CVE-2026-7533.md): Easy Digital Downloads \<= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square\_tokens' Parameter (CVSS 4.3)
- [CVE-2026-8832](https://cve.now/CVE-2026-8832.md): WPCode \<= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost (CVSS 8.8)
- [CVE-2026-7636](https://cve.now/CVE-2026-7636.md): Slider by Soliloquy \<= 2.8.1 - Authenticated (Subscriber+) Information Disclosure via REST API Endpoint (CVSS 4.3)
- [CVE-2026-6566](https://cve.now/CVE-2026-6566.md): Photo Gallery, Sliders, Proofing and Themes \<= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API (CVSS 4.3)
- [CVE-2026-5075](https://cve.now/CVE-2026-5075.md): All in One SEO \<= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data (CVSS 4.3)
- [CVE-2026-5361](https://cve.now/CVE-2026-5361.md): Envira Gallery \<= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter (CVSS 6.4)
- [CVE-2026-6177](https://cve.now/CVE-2026-6177.md): Custom Twitter Feeds \<= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Text (CVSS 7.2)
- [CVE-2026-7619](https://cve.now/CVE-2026-7619.md): Charitable \<= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter (CVSS 6.5)
- [CVE-2026-5488](https://cve.now/CVE-2026-5488.md): ExactMetrics \<= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics\_ads\_get\_token' (CVSS 5.3)
- [CVE-2026-5464](https://cve.now/CVE-2026-5464.md): ExactMetrics \<= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics\_connect\_process (CVSS 7.2)
- [CVE-2026-3177](https://cve.now/CVE-2026-3177.md): Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More \<= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook (CVSS 5.3)
- [CVE-2026-1463](https://cve.now/CVE-2026-1463.md): Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery \<= 4.0.4 - Authenticated (Author+) Local File Inclusion (CVSS 8.8)
- [CVE-2026-1992](https://cve.now/CVE-2026-1992.md): ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation (CVSS 8.8)
- [CVE-2026-1993](https://cve.now/CVE-2026-1993.md): ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update (CVSS 8.8)
- [CVE-2026-1236](https://cve.now/CVE-2026-1236.md): Envira Gallery for WordPress \<= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified\_gallery\_theme' Parameter via REST API (CVSS 6.4)
- [CVE-2026-2471](https://cve.now/CVE-2026-2471.md): WP Mail Logging \<= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field (CVSS 7.5)
- [CVE-2025-14384](https://cve.now/CVE-2025-14384.md): All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic \<= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure (CVSS 4.3)
- [CVE-2025-14783](https://cve.now/CVE-2025-14783.md): Easy Digital Downloads \<= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd\_redirect (CVSS 4.3)
- [CVE-2025-13641](https://cve.now/CVE-2025-13641.md): Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery \<= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template' (CVSS 8.8)
- [CVE-2025-12484](https://cve.now/CVE-2025-12484.md): Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers \<= 1.12.19 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2025-12847](https://cve.now/CVE-2025-12847.md): All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic \<= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion (CVSS 4.3)
- [CVE-2025-12377](https://cve.now/CVE-2025-12377.md): Gallery Plugin for WordPress – Envira Photo Gallery \<= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions (CVSS 4.3)
- [CVE-2025-11448](https://cve.now/CVE-2025-11448.md): Gallery Plugin for WordPress – Envira Photo Gallery \<= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion (CVSS 4.3)
- [CVE-2025-12837](https://cve.now/CVE-2025-12837.md): aThemes Addons for Elementor \<= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget (CVSS 6.4)
- [CVE-2025-11271](https://cve.now/CVE-2025-11271.md): Easy Digital Download \<= 3.5.2 - Insufficient Verification to Order Manipulation (CVSS 5.3)
- [CVE-2025-11893](https://cve.now/CVE-2025-11893.md): Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More \<= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5)
- [CVE-2025-10694](https://cve.now/CVE-2025-10694.md): User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds \<= 1.8.0 - Missing Authorization to Information Disclosure (CVSS 5.3)
- [CVE-2025-8149](https://cve.now/CVE-2025-8149.md): aThemes Addons for Elementor Lite \<= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4)
- [CVE-2025-8102](https://cve.now/CVE-2025-8102.md): Easy Digital Downloads \<= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd\_sendwp\_disconnect and edd\_sendwp\_remote\_install Functions (CVSS 5.4)
- [CVE-2025-2537](https://cve.now/CVE-2025-2537.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library (CVSS 6.4)
- [CVE-2025-5275](https://cve.now/CVE-2025-5275.md): Charitable \<= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings (CVSS 4.4)
- [CVE-2025-4577](https://cve.now/CVE-2025-4577.md): Smash Balloon Custom Facebook Feed \<= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via \`data-color\` Attribute (CVSS 6.4)
- [CVE-2025-4670](https://cve.now/CVE-2025-4670.md): Easy Digital Downloads \<= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd\_receipt Shortcode (CVSS 6.4)
- [CVE-2025-4583](https://cve.now/CVE-2025-4583.md): Smash Balloon Instagram Feed \<= 6.9.0 (Free) & \<= 6.8.0 (Pro) - Authenticated (Contributor+) Stored Cross-Site Scripting via \`data-plugin\` Attribute (CVSS 5.4)
- [CVE-2024-5878](https://cve.now/CVE-2024-5878.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library (CVSS 6.4)
- [CVE-2025-2892](https://cve.now/CVE-2025-2892.md): All in One SEO Pack \<= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL (CVSS 6.4)
- [CVE-2025-3794](https://cve.now/CVE-2025-3794.md): WPForms Lite \<= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start\_timestamp' Parameter (CVSS 5.4)
- [CVE-2025-2252](https://cve.now/CVE-2025-2252.md): Easy Digital Downloads – eCommerce Payments and Subscriptions made easy \<= 3.3.6.1 - Unauthenticated Private Post Title Disclosure (CVSS 5.3)
- [CVE-2025-1314](https://cve.now/CVE-2025-1314.md): Custom Twitter Feeds \<= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf\_clear\_cache\_admin Function (CVSS 4.3)
- [CVE-2024-13403](https://cve.now/CVE-2024-13403.md): WPForms Lite \<= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter (CVSS 6.4)
- [CVE-2024-13547](https://cve.now/CVE-2024-13547.md): aThemes Addons for Elementor \<= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-13453](https://cve.now/CVE-2024-13453.md): Contact Form & SMTP Plugin for WordPress by PirateForms \<= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3)
- [CVE-2024-13517](https://cve.now/CVE-2024-13517.md): Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) \<= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title (CVSS 4.4)
- [CVE-2024-12875](https://cve.now/CVE-2024-12875.md): Easy Digital Downloads \<= 3.3.2 - Authenticated (Admin+) Arbitrary File Download (CVSS 4.9)
- [CVE-2024-9654](https://cve.now/CVE-2024-9654.md): Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass (CVSS 3.7)
- [CVE-2024-11205](https://cve.now/CVE-2024-11205.md): WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation (CVSS 8.5)
- [CVE-2024-5020](https://cve.now/CVE-2024-5020.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library (CVSS 6.4)
- [CVE-2024-10878](https://cve.now/CVE-2024-10878.md): Sugar Calendar (Lite) \<= 3.3.0 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-10593](https://cve.now/CVE-2024-10593.md): WPForms – Easy Form Builder for WordPress \<= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion (CVSS 4.3)
- [CVE-2024-10876](https://cve.now/CVE-2024-10876.md): Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More \<= 1.8.3 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-10045](https://cve.now/CVE-2024-10045.md): Transients Manager \<= 2.0.6 - Cross-Site Request Forgery (CVSS 4.3)
- [CVE-2022-2439](https://cve.now/CVE-2022-2439.md): Easy Digital Downloads – Simple eCommerce for Selling Digital Files \<= 3.3.3 - Authenticated (Admin+) PHAR Deserialization (CVSS 7.2)
- [CVE-2024-8791](https://cve.now/CVE-2024-8791.md): Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress \<= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation (CVSS 9.8)
- [CVE-2024-8199](https://cve.now/CVE-2024-8199.md): Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More \<= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update (CVSS 4.3)
- [CVE-2024-8200](https://cve.now/CVE-2024-8200.md): Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More \<= 1.1.2 - Cross-Site Request Forgery (CVSS 4.3)
- [CVE-2024-6692](https://cve.now/CVE-2024-6692.md): Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) \<= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text (CVSS 3.3)
- [CVE-2024-6691](https://cve.now/CVE-2024-6691.md): Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) \<= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings (CVSS 4.4)
- [CVE-2024-6897](https://cve.now/CVE-2024-6897.md): aThemes Starter Sites \<= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4)
- [CVE-2024-6694](https://cve.now/CVE-2024-6694.md): WP Mail SMTP \<= 4.0.1 - Authenticated (Admin+) SMTP Password Exposure (CVSS 2.7)
- [CVE-2024-5902](https://cve.now/CVE-2024-5902.md): UserFeedback Lite \<= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Name Parameter (CVSS 7.2)
- [CVE-2024-6256](https://cve.now/CVE-2024-6256.md): Feeds for YouTube (YouTube video, channel, and gallery plugin) \<= 2.2.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-6210](https://cve.now/CVE-2024-6210.md): Duplicator \<= 1.5.9 - Full Path Disclosure (CVSS 5.3)
- [CVE-2024-6263](https://cve.now/CVE-2024-6263.md): WP Lightbox 2 \<= 3.0.6.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-3073](https://cve.now/CVE-2024-3073.md): Easy WP SMTP by SendLayer \<= 2.3.0 - Exposure of Sensitive Information via the UI (CVSS 2.7)
- [CVE-2024-4045](https://cve.now/CVE-2024-4045.md): Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation \<= 2.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-4473](https://cve.now/CVE-2024-4473.md): Sydney Toolbox \<= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio Widget (CVSS 6.4)
- [CVE-2024-4036](https://cve.now/CVE-2024-4036.md): Sydney Toolbox \<= 1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-3649](https://cve.now/CVE-2024-3649.md): Contact Form by WPForms – Drag & Drop Form Builder for WordPress \<= 1.8.7.2 - Unauthenticated Price Manipulation (CVSS 5.3)
- [CVE-2024-3554](https://cve.now/CVE-2024-3554.md): All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic \<= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2024-3208](https://cve.now/CVE-2024-3208.md): Sydney Toolbox \<= 1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery (CVSS 6.4)
- [CVE-2024-3097](https://cve.now/CVE-2024-3097.md): WordPress Gallery Plugin – NextGEN Gallery \<= 3.59 - Missing Authorization to Unauthenticated Information Disclosure (CVSS 5.3)
- [CVE-2024-2302](https://cve.now/CVE-2024-2302.md): Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) \<= 3.2.9 - Sensitive Information Exposure (CVSS 5.3)
- [CVE-2024-2936](https://cve.now/CVE-2024-2936.md): Sydney Toolbox \<= 1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via \_id (CVSS 6.4)
- [CVE-2024-1935](https://cve.now/CVE-2024-1935.md): Giveaways and Contests by RafflePress \<= 1.12.5 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2024-0903](https://cve.now/CVE-2024-0903.md): User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds \<= 1.0.13 - Unauthenticated Stored Cross-Site Scripting (CVSS 5.4)
- [CVE-2024-0379](https://cve.now/CVE-2024-0379.md): Custom Twitter Feeds – A Tweets Widget or X Feed Widget \<= 2.2.1 - Cross-Site Request Forgery to Plugin Options Update (CVSS 4.3)
- [CVE-2024-1447](https://cve.now/CVE-2024-1447.md): Sydney Toolbox \<= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-0659](https://cve.now/CVE-2024-0659.md): Easy Digital Downloads \<= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options (CVSS 5.5)
- [CVE-2023-6742](https://cve.now/CVE-2023-6742.md): Envira Gallery Lite \<= 1.8.7.2 - Missing Authorization to Gallery Modification via envira\_gallery\_insert\_images (CVSS 4.3)
- [CVE-2023-5049](https://cve.now/CVE-2023-5049.md): Giveaways and Contests by RafflePress \<= 1.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2023-4841](https://cve.now/CVE-2023-4841.md): Feeds for YouTube \<= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2023-4404](https://cve.now/CVE-2023-4404.md): Donation Forms by Charitable \<= 1.7.0.12 - Unauthenticated Privilege Escalation (CVSS 9.8)
- [CVE-2023-3081](https://cve.now/CVE-2023-3081.md): WP Mail Logging \<= 1.11.1 - Unauthenticated Stored Cross-Site Scripting via Email (CVSS 7.2)
- [CVE-2019-25145](https://cve.now/CVE-2019-25145.md): Contact Form & SMTP Plugin by PirateForms \<= 2.5.1 - Unauthenticated HTML injection (CVSS 7.2)
- [CVE-2019-25141](https://cve.now/CVE-2019-25141.md): Easy WP SMTP \<= 1.3.9 - Missing Authorization to Arbitrary Options Update (CVSS 9.8)
- [CVE-2023-0586](https://cve.now/CVE-2023-0586.md): All in One SEO Pack \<= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2023-0585](https://cve.now/CVE-2023-0585.md): All in One SEO Pack \<= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/smub
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.