Smackcoders
24 CVEs across 16 Smackcoders products. Browse Smackcoders vulnerabilities, severities, and proof-of-concept exploits.
Smackcoders products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13353 | High | 8.8 | 2026-07-11 | The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress is vulnerable to Remote Code Execution in all versions up to… |
CVE-2026-1317 | Medium | 6.5 | 2026-02-18 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 7.37. This is… |
CVE-2025-14627 | Medium | 6.4 | 2026-01-01 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including… |
CVE-2025-13606 | Medium | 6.5 | 2025-12-02 | The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2025-13145 | High | 7.2 | 2025-11-19 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.33.1… |
CVE-2025-12732 | Medium | 4.3 | 2025-11-12 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing aut… |
CVE-2025-10058 | High | 8.1 | 2025-09-17 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation… |
CVE-2025-10057 | High | 8.8 | 2025-09-17 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.28… |
CVE-2025-10040 | High | 7.7 | 2025-09-10 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on… |
CVE-2025-9990 | High | 8.1 | 2025-09-05 | The WordPress Helpdesk Integration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.8.10 via the portal_type… |
CVE-2025-5692 | Medium | 6.3 | 2025-07-02 | The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/… |
CVE-2025-2008 | High | 8.8 | 2025-04-01 | The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import… |
CVE-2025-2007 | High | 8.1 | 2025-04-01 | The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the… |
CVE-2025-2332 | Critical | 9.8 | 2025-03-27 | The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.13 v… |
CVE-2024-12315 | High | 7.5 | 2025-02-12 | The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includi… |
CVE-2024-9364 | Medium | 4.3 | 2024-10-18 | The SendGrid for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_mailplus_clear_logs' fu… |
CVE-2024-43965 | High | 8.2 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders SendGrid for WordPress allows SQL Injection.T… |
CVE-2023-2487 | Medium | 5.9 | 2023-12-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects… |
CVE-2023-45066 | Medium | 5.9 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects… |
CVE-2015-10125 | Medium | 4.3 | 2023-10-05 | A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation… |
CVE-2023-4142 | High | 8.0 | 2023-08-04 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. Th… |
CVE-2023-4141 | High | 8.0 | 2023-08-04 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. Th… |
CVE-2023-4140 | Medium | 6.6 | 2023-08-04 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction… |
CVE-2023-4139 | High | 7.5 | 2023-08-04 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export f… |
CVE-2022-3860 | High | 8.8 | 2023-01-02 | The Visual Email Designer for WooCommerce WordPress plugin before 1.7.2 does not properly sanitise and escape a parameter before using it in a SQL statement, l… |
CVE-2022-3244 | Medium | 4.2 | 2022-10-17 | The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not have authorisation in some places, which could allow any authenticated users to access som… |
CVE-2022-3243 | High | 7.2 | 2022-10-17 | The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading… |
CVE-2022-1977 | High | 7.2 | 2022-06-27 | The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before maki… |
CVE-2022-0360 | Medium | 4.8 | 2022-02-28 | The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow h… |
CVE-2016-11000 | Critical | 9.8 | 2019-09-20 | The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter. |
CVE-2016-10985 | Medium | 6.1 | 2019-09-17 | The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter. |
CVE-2016-10984 | Medium | 6.1 | 2019-09-17 | The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter. |
CVE-2018-20968 | High | 8.8 | 2019-08-14 | The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF. |
CVE-2018-20967 | High | 8.8 | 2019-08-14 | The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF. |
CVE-2015-9306 | Medium | 6.1 | 2019-08-12 | The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS. |
CVE-2013-3264 | | 2013-11-05 | The WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress does not properly restrict access to (1) list/edit.php and (2) campaign/editCamp… | |
CVE-2013-3263 | | 2013-11-05 | Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow remote attackers to… |