Smub
91 CVEs across 30 Smub products. Browse Smub vulnerabilities, severities, and proof-of-concept exploits.
Smub products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15452 | Medium | 4.7 | 2026-08-05 | The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query Strin… |
CVE-2026-12476 | High | 7.2 | 2026-07-29 | The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file… |
CVE-2026-15782 | Medium | 4.9 | 2026-07-21 | The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Sc… |
CVE-2026-12002 | Medium | 4.7 | 2026-07-08 | The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl… |
CVE-2026-12127 | Medium | 5.3 | 2026-07-01 | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Improper Neutralization of… |
CVE-2026-8613 | Medium | 6.4 | 2026-06-10 | The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title_tag' Widget Setting in all versions up to, and in… |
CVE-2026-7792 | Medium | 5.3 | 2026-06-06 | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Insufficient Verification o… |
CVE-2026-10038 | Medium | 4.3 | 2026-06-06 | The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insecure Direct Object Refer… |
CVE-2026-7526 | Medium | 4.3 | 2026-05-28 | The PDF Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.9.3 via the enqueue_block_assets… |
CVE-2026-7533 | Medium | 4.3 | 2026-05-28 | The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.7. This is due to missing… |
CVE-2026-8832 | High | 8.8 | 2026-05-27 | The WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager plugin for WordPress is vulnerable to Remote Code Execution in versions… |
CVE-2026-7636 | Medium | 4.3 | 2026-05-22 | The Slider by Soliloquy – Responsive Image Slider for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and… |
CVE-2026-6566 | Medium | 4.3 | 2026-05-20 | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and… |
CVE-2026-5075 | Medium | 4.3 | 2026-05-20 | The All in One SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via 'internalOptions' localized script data in versions up to, and incl… |
CVE-2026-5361 | Medium | 6.4 | 2026-05-14 | The Envira Gallery Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in versions up to and including 1.12.4. This is due… |
CVE-2026-6177 | High | 7.2 | 2026-05-13 | The Custom Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.5.4. This is due to insufficient o… |
CVE-2026-7619 | Medium | 6.5 | 2026-05-13 | The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to generic SQL Injection via th… |
CVE-2026-5488 | Medium | 5.3 | 2026-04-24 | The ExactMetrics – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 9.1.2… |
CVE-2026-5464 | High | 7.2 | 2026-04-23 | The ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) plugin for WordPress is vulnerable to unauthorized arbitrary plugin installa… |
CVE-2026-3177 | Medium | 5.3 | 2026-04-07 | The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insufficient Verification of… |
CVE-2026-1463 | High | 8.8 | 2026-03-18 | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includi… |
CVE-2026-1993 | High | 8.8 | 2026-03-11 | The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due… |
CVE-2026-1992 | High | 8.8 | 2026-03-11 | The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Insecure Direct Object Reference in versions 8.6.0 through 9.0.2. This is d… |
CVE-2026-1236 | Medium | 6.4 | 2026-03-04 | The Envira Gallery for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'justified_gallery_theme' parameter in all versions… |
CVE-2026-2471 | High | 7.5 | 2026-02-28 | The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted in… |
CVE-2025-14384 | Medium | 4.3 | 2026-01-16 | The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized access of data due to a mi… |
CVE-2025-14783 | Medium | 4.3 | 2025-12-31 | The Easy Digital Downloads plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.6.2. This is due to insufficient… |
CVE-2025-13641 | High | 8.8 | 2025-12-18 | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includi… |
CVE-2025-12484 | High | 7.2 | 2025-11-19 | The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to Stored Cros… |
CVE-2025-12847 | Medium | 4.3 | 2025-11-15 | The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment… |
CVE-2025-12377 | Medium | 4.3 | 2025-11-13 | The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-12837 | Medium | 6.4 | 2025-11-08 | The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Call To Action widget in versions up to, and includi… |
CVE-2025-11448 | Medium | 4.3 | 2025-11-08 | The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-11271 | Medium | 5.3 | 2025-11-06 | The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification by… |
CVE-2025-11893 | Medium | 6.5 | 2025-10-25 | The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to SQL Injection via the donati… |
CVE-2025-10694 | Medium | 5.3 | 2025-10-25 | The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to unauthorized access of data due… |
CVE-2025-8149 | Medium | 6.4 | 2025-09-06 | The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and… |
CVE-2025-8102 | Medium | 5.4 | 2025-08-20 | The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing… |
CVE-2025-2537 | Medium | 6.4 | 2025-07-03 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScript library (version 3.1) in various vers… |
CVE-2025-5275 | Medium | 4.4 | 2025-06-26 | The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2025-4577 | Medium | 6.4 | 2025-06-10 | The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-color att… |
CVE-2025-4670 | Medium | 6.4 | 2025-05-29 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… |
CVE-2025-4583 | Medium | 5.4 | 2025-05-29 | The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-plugin` attribut… |
CVE-2024-5878 | Medium | 6.4 | 2025-05-20 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in vari… |
CVE-2025-2892 | Medium | 6.4 | 2025-05-19 | The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pos… |
CVE-2025-3794 | Medium | 5.4 | 2025-05-09 | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2025-2252 | Medium | 5.3 | 2025-03-25 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all version… |
CVE-2025-1314 | Medium | 4.3 | 2025-03-20 | The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2024-13403 | Medium | 6.4 | 2025-02-04 | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2024-13547 | Medium | 6.4 | 2025-02-01 | The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all versions up to, and in… |
CVE-2024-13453 | High | 7.3 | 2025-01-30 | The The Contact Form & SMTP Plugin for WordPress by PirateForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and… |
CVE-2024-13517 | Medium | 4.4 | 2025-01-18 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title val… |
CVE-2024-12875 | Medium | 4.9 | 2024-12-21 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, an… |
CVE-2024-9654 | Low | 3.7 | 2024-12-17 | The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient vali… |
CVE-2024-11205 | High | 8.5 | 2024-12-10 | The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function i… |
CVE-2024-5020 | Medium | 6.4 | 2024-12-04 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in… |
CVE-2024-10878 | Medium | 6.1 | 2024-11-26 | The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_quer… |
CVE-2024-10593 | Medium | 4.3 | 2024-11-13 | The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Site Request Forgery… |
CVE-2024-10876 | Medium | 6.1 | 2024-11-09 | The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripti… |
CVE-2024-10045 | Medium | 4.3 | 2024-10-23 | The Transients Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or… |
CVE-2024-8791 | Critical | 9.8 | 2024-09-24 | The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all vers… |
CVE-2022-2439 | High | 7.2 | 2024-09-24 | The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted input via the 'uploa… |
CVE-2024-8200 | Medium | 4.3 | 2024-08-27 | The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to Cross-Site Requ… |
CVE-2024-8199 | Medium | 4.3 | 2024-08-27 | The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to unauthorized mo… |
CVE-2024-6692 | Low | 3.3 | 2024-08-12 | The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2024-6691 | Medium | 4.4 | 2024-08-12 | The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2024-6897 | Medium | 6.4 | 2024-07-27 | The aThemes Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.53 d… |
CVE-2024-6694 | Low | 2.7 | 2024-07-20 | The WP Mail SMTP plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 4.0.1. This is due to plugin providing the SM… |
CVE-2024-5902 | High | 7.2 | 2024-07-12 | The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-6256 | Medium | 6.4 | 2024-07-11 | The Feeds for YouTube (YouTube video, channel, and gallery plugin) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'youtube-… |
CVE-2024-6210 | Medium | 5.3 | 2024-07-11 | The Duplicator plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 1.5.9. This makes it possible for unauthenticat… |
CVE-2024-6263 | Medium | 6.4 | 2024-07-03 | The WP Lightbox 2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 3.0.6.6 due… |
CVE-2024-3073 | Low | 2.7 | 2024-06-13 | The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versions up to, and inclu… |
CVE-2024-4045 | Medium | 6.4 | 2024-05-25 | The Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2024-4473 | Medium | 6.4 | 2024-05-14 | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "aThemes: Portfolio" widget in all versions up to, and including… |
CVE-2024-4036 | Medium | 6.4 | 2024-05-02 | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in all versions up to, and including, 1.30 due to… |
CVE-2024-3649 | Medium | 5.3 | 2024-05-02 | The Contact Form by WPForms – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to price manipulation in versions up to, and including… |
CVE-2024-3554 | Medium | 6.4 | 2024-05-02 | The All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2024-3208 | Medium | 6.4 | 2024-04-09 | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and incl… |
CVE-2024-3097 | Medium | 5.3 | 2024-04-09 | The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_i… |
CVE-2024-2302 | Medium | 5.3 | 2024-04-09 | The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Sensitive Informat… |
CVE-2024-2936 | Medium | 6.4 | 2024-03-29 | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id attribute of widgets in all versions up to, and including, 1.2… |
CVE-2024-1935 | High | 7.2 | 2024-03-13 | The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to Stored Cros… |
CVE-2024-1447 | Medium | 6.4 | 2024-02-29 | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aThemes Slider button element in all versions up to, and… |
CVE-2024-0379 | Medium | 4.3 | 2024-02-29 | The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2024-0903 | Medium | 5.4 | 2024-02-22 | The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-0659 | Medium | 5.5 | 2024-02-05 | The Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… |
CVE-2023-6742 | Medium | 4.3 | 2024-01-11 | The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability c… |
CVE-2023-5049 | Medium | 6.4 | 2023-10-30 | The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rafflepress' and 'rafflepress_gutenberg' s… |
CVE-2023-4841 | Medium | 6.4 | 2023-09-14 | The Feeds for YouTube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube-feed' shortcode in versions up to, and including, 2.1 due… |
CVE-2023-4404 | Critical | 9.8 | 2023-08-23 | The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient rest… |
CVE-2023-3081 | High | 7.2 | 2023-07-12 | The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.11.1 due to insuff… |
CVE-2019-25145 | High | 7.2 | 2023-06-07 | The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in version… |
CVE-2019-25141 | Critical | 9.8 | 2023-06-07 | The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks o… |
CVE-2023-0586 | Medium | 6.4 | 2023-02-24 | The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due t… |
CVE-2023-0585 | Medium | 4.4 | 2023-02-24 | The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due t… |