CVE-2026-77189Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute Exploitation status Not known exploited Fix Affected product C Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) Published 09/01/2026 Severity Medium CVE-2026-3423Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description Exploitation status Not known exploited Fix Affected product E Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More Published 08/28/2026 Severity Medium CVE-2026-16775Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute Exploitation status Not known exploited Fix Affected product S Smash Balloon Social Post Feed – Simple Social Feeds for WordPress Published 08/16/2026 Severity Medium CVE-2026-15452Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String Exploitation status Not known exploited Fix Affected product S Smash Balloon Social Photo Feed – Easy Social Feeds Plugin Published 08/05/2026 Severity Medium CVE-2026-12476Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter Exploitation status Not known exploited Fix Affected product E Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Published 07/29/2026 Severity High CVE-2026-15782WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content Exploitation status Not known exploited Fix Affected product W WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More Published 07/21/2026 Severity Medium CVE-2026-12002Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter Exploitation status Not known exploited Fix Affected product S Smash Balloon Social Photo Feed – Easy Social Feeds Plugin Published 07/08/2026 Severity Medium CVE-2026-12127WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name Exploitation status Not known exploited Fix Affected product W WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More Published 07/01/2026 Severity Medium CVE-2026-8613aThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Setting Exploitation status Not known exploited Fix Affected product A aThemes Addons for Elementor Published 06/10/2026 Severity Medium CVE-2026-7792WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint Exploitation status Not known exploited Fix Affected product W WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More Published 06/06/2026 Severity Medium CVE-2026-10038Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter Exploitation status Not known exploited Fix Affected product C Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Published 06/05/2026 Severity Medium CVE-2026-7526PDF Embedder <= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Page Exploitation status Not known exploited Fix Affected product P PDF Embedder – PDF Viewer & Embed PDF Files for WordPress Published 05/28/2026 Severity Medium CVE-2026-7533Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter Exploitation status Not known exploited Fix Affected product E Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Published 05/28/2026 Severity Medium CVE-2026-8832WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost Exploitation status Not known exploited Fix Affected product W WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager Published 05/27/2026 Severity High CVE-2026-7636Slider by Soliloquy <= 2.8.1 - Authenticated (Subscriber+) Information Disclosure via REST API Endpoint Exploitation status Not known exploited Fix Affected product S Slider by Soliloquy – Responsive Image Slider for WordPress Published 05/22/2026 Severity Medium CVE-2026-6566Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API Exploitation status Not known exploited Fix Affected product P Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery Published 05/20/2026 Severity Medium CVE-2026-5075All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data Exploitation status Not known exploited Fix Affected product A All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic Published 05/20/2026 Severity Medium CVE-2026-5361Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter Exploitation status Not known exploited Fix Affected product E Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More Published 05/14/2026 Severity Medium CVE-2026-6177Custom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Text Exploitation status Not known exploited Fix Affected product C Custom Twitter Feeds – A Tweets Widget or X Feed Widget Published 05/13/2026 Severity High CVE-2026-7619Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter Exploitation status Not known exploited Fix Affected product C Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Published 05/13/2026 Severity Medium CVE-2026-5488ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token' Exploitation status Not known exploited Fix Affected product E ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) Published 04/24/2026 Severity Medium CVE-2026-5464ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process Exploitation status Not known exploited Fix Affected product E ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) Published 04/23/2026 Severity High CVE-2026-3177Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook Exploitation status Not known exploited Fix Affected product C Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Published 04/07/2026 Severity Medium CVE-2026-1463Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion Exploitation status Not known exploited Fix Affected product P Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery Published 03/18/2026 Severity High CVE-2026-1992ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation Exploitation status Not known exploited Fix Affected product E ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) Published 03/11/2026 Severity High CVE-2026-1993ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update Exploitation status Not known exploited Fix Affected product E ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) Published 03/11/2026 Severity High CVE-2026-1236Envira Gallery for WordPress <= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST API Exploitation status Not known exploited Fix Affected product E Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More Published 03/04/2026 Severity Medium CVE-2026-2471WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field Exploitation status Not known exploited Fix Affected product W WP Mail Logging Published 02/28/2026 Severity High CVE-2025-14384All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure Exploitation status Not known exploited Fix Affected product A All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic Published 01/16/2026 Severity Medium CVE-2025-14783Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect Exploitation status Not known exploited Fix Affected product E Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Published 12/31/2025 Severity Medium CVE-2025-13641Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template' Exploitation status Not known exploited Fix Affected product P Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery Published 12/18/2025 Severity High CVE-2025-12484Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.19 - Unauthenticated Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product G Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers Published 11/19/2025 Severity High CVE-2025-12847All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion Exploitation status Not known exploited Fix Affected product A All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic Published 11/15/2025 Severity Medium CVE-2025-12377Gallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions Exploitation status Not known exploited Fix Affected product E Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More Published 11/13/2025 Severity Medium CVE-2025-11448Gallery Plugin for WordPress – Envira Photo Gallery <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion Exploitation status Not known exploited Fix Affected product E Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More Published 11/08/2025 Severity Medium CVE-2025-12837aThemes Addons for Elementor <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget Exploitation status Not known exploited Fix Affected product A aThemes Addons for Elementor Published 11/08/2025 Severity Medium CVE-2025-11271Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation Exploitation status Not known exploited Fix Affected product E Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Published 11/06/2025 Severity Medium CVE-2025-11893Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection Exploitation status Not known exploited Fix Affected product C Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Published 10/25/2025 Severity Medium CVE-2025-10694User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.8.0 - Missing Authorization to Information Disclosure Exploitation status Not known exploited Fix Affected product U UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds Published 10/25/2025 Severity Medium CVE-2025-8149aThemes Addons for Elementor Lite <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget Exploitation status Not known exploited Fix Affected product A aThemes Addons for Elementor Published 09/06/2025 Severity Medium CVE-2025-8102Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions Exploitation status Not known exploited Fix Affected product E Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Published 08/20/2025 Severity Medium CVE-2025-2537Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library Exploitation status Not known exploited Fix Affected product P Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery Published 07/03/2025 Severity Medium CVE-2025-5275Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings Exploitation status Not known exploited Fix Affected product C Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Published 06/26/2025 Severity Medium CVE-2025-4577Smash Balloon Custom Facebook Feed <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute Exploitation status Not known exploited Fix Affected product S Smash Balloon Social Post Feed – Simple Social Feeds for WordPress Published 06/10/2025 Severity Medium CVE-2025-4670Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode Exploitation status Not known exploited Fix Affected product E Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Published 05/29/2025 Severity Medium CVE-2025-4583Smash Balloon Instagram Feed <= 6.9.0 (Free) & <= 6.8.0 (Pro) - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-plugin` Attribute Exploitation status Not known exploited Fix Affected product S Smash Balloon Social Photo Feed – Easy Social Feeds Plugin Published 05/29/2025 Severity Medium CVE-2024-5878Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library Exploitation status Not known exploited Fix Affected product P Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery Published 05/20/2025 Severity Medium CVE-2025-2892All in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL Exploitation status Not known exploited Fix Affected product A All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic Published 05/19/2025 Severity Medium CVE-2025-3794WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter Exploitation status Not known exploited Fix Affected product W WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More Published 05/09/2025 Severity Medium CVE-2025-2252Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure Exploitation status Not known exploited Fix Affected product E Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Published 03/25/2025 Severity Medium CVE-2025-1314Custom Twitter Feeds <= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function Exploitation status Not known exploited Fix Affected product C Custom Twitter Feeds – A Tweets Widget or X Feed Widget Published 03/20/2025 Severity Medium CVE-2024-13403WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter Exploitation status Not known exploited Fix Affected product W WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More Published 02/04/2025 Severity Medium CVE-2024-13547aThemes Addons for Elementor <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product A aThemes Addons for Elementor Published 02/01/2025 Severity Medium CVE-2024-13453Contact Form & SMTP Plugin for WordPress by PirateForms <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution Exploitation status Not known exploited Fix Affected product C Contact Form & SMTP Plugin for WordPress by PirateForms Published 01/30/2025 Severity High CVE-2024-13517Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title Exploitation status Not known exploited Fix Affected product E Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Published 01/18/2025 Severity Medium CVE-2024-12875Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download Exploitation status Not known exploited Fix Affected product E Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Published 12/21/2024 Severity Medium CVE-2024-9654Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass Exploitation status Not known exploited Fix Affected product E Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Published 12/17/2024 Severity Low CVE-2024-11205WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation Exploitation status Not known exploited Fix Affected product W WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More Published 12/10/2024 Severity High CVE-2024-5020Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library Exploitation status Not known exploited Fix Affected product E Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More Published 12/04/2024 Severity Medium CVE-2024-10878Sugar Calendar (Lite) <= 3.3.0 - Reflected Cross-Site Scripting Exploitation status Not known exploited Fix Affected product S Sugar Calendar – Events Calendar, Event Tickets, and Events Management Platform Published 11/26/2024 Severity Medium CVE-2024-10593WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion Exploitation status Not known exploited Fix Affected product W WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More Published 11/13/2024 Severity Medium CVE-2024-10876Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting Exploitation status Not known exploited Fix Affected product C Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Published 11/09/2024 Severity Medium CVE-2024-10045Transients Manager <= 2.0.6 - Cross-Site Request Forgery Exploitation status Not known exploited Fix Affected product T Transients Manager Published 10/23/2024 Severity Medium CVE-2022-2439Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization Exploitation status Not known exploited Fix Affected product E Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Published 09/24/2024 Severity High CVE-2024-8791Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation Exploitation status Not known exploited Fix Affected product C Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Published 09/24/2024 Severity Critical CVE-2024-8199Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update Exploitation status Not known exploited Fix Affected product R Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More Published 08/27/2024 Severity Medium CVE-2024-8200Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More <= 1.1.2 - Cross-Site Request Forgery Exploitation status Not known exploited Fix Affected product R Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More Published 08/27/2024 Severity Medium CVE-2024-6692Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text Exploitation status Not known exploited Fix Affected product E Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Published 08/10/2024 Severity Low CVE-2024-6691Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings Exploitation status Not known exploited Fix Affected product E Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Published 08/10/2024 Severity Medium CVE-2024-6897aThemes Starter Sites <= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload Exploitation status Not known exploited Fix Affected product A aThemes Starter Sites Published 07/27/2024 Severity Medium CVE-2024-6694WP Mail SMTP <= 4.0.1 - Authenticated (Admin+) SMTP Password Exposure Exploitation status Not known exploited Fix Affected product W WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin Published 07/20/2024 Severity Low CVE-2024-5902UserFeedback Lite <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Name Parameter Exploitation status Not known exploited Fix Affected product U UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds Published 07/12/2024 Severity High CVE-2024-6256Feeds for YouTube (YouTube video, channel, and gallery plugin) <= 2.2.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product F Feeds for YouTube (YouTube video, channel, and gallery plugin) Published 07/11/2024 Severity Medium CVE-2024-6210Duplicator <= 1.5.9 - Full Path Disclosure Exploitation status Not known exploited Fix Affected product D Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More Published 07/11/2024 Severity Medium CVE-2024-6263WP Lightbox 2 <= 3.0.6.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product W WP Lightbox 2 Published 07/03/2024 Severity Medium CVE-2024-3073Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UI Exploitation status Not known exploited Fix Affected product E Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more Published 06/13/2024 Severity Low CVE-2024-4045Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation <= 2.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product P Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation Published 05/25/2024 Severity Medium CVE-2024-4473Sydney Toolbox <= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio Widget Exploitation status Not known exploited Fix Affected product S Sydney Toolbox Published 05/14/2024 Severity Medium CVE-2024-4036Sydney Toolbox <= 1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product S Sydney Toolbox Published 05/02/2024 Severity Medium CVE-2024-3649Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation Exploitation status Not known exploited Fix Affected product W WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More Published 05/02/2024 Severity Medium CVE-2024-3554All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product A All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic Published 05/02/2024 Severity Medium CVE-2024-3208Sydney Toolbox <= 1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery Exploitation status Not known exploited Fix Affected product S Sydney Toolbox Published 04/09/2024 Severity Medium CVE-2024-3097WordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure Exploitation status Not known exploited Fix Affected product P Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery Published 04/09/2024 Severity Medium CVE-2024-2302Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product E Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Published 04/09/2024 Severity Medium CVE-2024-2936Sydney Toolbox <= 1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Exploitation status Not known exploited Fix Affected product S Sydney Toolbox Published 03/29/2024 Severity Medium CVE-2024-1935Giveaways and Contests by RafflePress <= 1.12.5 - Unauthenticated Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product G Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers Published 03/13/2024 Severity High CVE-2024-0903User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.0.13 - Unauthenticated Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product U UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds Published 02/22/2024 Severity Medium CVE-2024-0379Custom Twitter Feeds – A Tweets Widget or X Feed Widget <= 2.2.1 - Cross-Site Request Forgery to Plugin Options Update Exploitation status Not known exploited Fix Affected product C Custom Twitter Feeds – A Tweets Widget or X Feed Widget Published 02/20/2024 Severity Medium CVE-2024-1447Sydney Toolbox <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product S Sydney Toolbox Published 02/20/2024 Severity Medium CVE-2024-0659Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options Exploitation status Not known exploited Fix Affected product E Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Published 02/05/2024 Severity Medium CVE-2023-6742Envira Gallery Lite <= 1.8.7.2 - Missing Authorization to Gallery Modification via envira_gallery_insert_images Exploitation status Not known exploited Fix Affected product E Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More Published 01/11/2024 Severity Medium CVE-2023-5049Giveaways and Contests by RafflePress <= 1.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product G Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers Published 10/30/2023 Severity Medium CVE-2023-4841Feeds for YouTube <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product F Feeds for YouTube (YouTube video, channel, and gallery plugin) Published 09/14/2023 Severity Medium CVE-2023-4404Donation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege Escalation Exploitation status Not known exploited Fix Affected product C Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Published 08/23/2023 Severity Critical CVE-2023-3081WP Mail Logging <= 1.11.1 - Unauthenticated Stored Cross-Site Scripting via Email Exploitation status Not known exploited Fix Affected product W WP Mail Logging Published 07/12/2023 Severity High CVE-2019-25145Contact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injection Exploitation status Not known exploited Fix Affected product C Contact Form & SMTP Plugin for WordPress by PirateForms Published 06/07/2023 Severity High CVE-2019-25141Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update Exploitation status Not known exploited Fix Affected product E Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more Published 06/07/2023 Severity Critical CVE-2023-0586All in One SEO Pack <= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product A All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic Published 02/24/2023 Severity Medium CVE-2023-0585All in One SEO Pack <= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product A All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic Published 02/24/2023 Severity Medium 
.svg){kind=icon}
.svg){kind=icon}
.svg){kind=icon}
