Iinc2734

Products

Exploited and recent CVEs

• CVE-2026-2594 Medium 6.4 Smart Custom Fields <= 5.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title 0.3%
• CVE-2026-3004 Medium 6.4 Snow Monkey Blocks <= 24.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' Attribute 0.2%
• CVE-2026-5436 High 8.1 MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys 1.1%
• CVE-2026-4347 High 8.1 MW WP Form <= 5.1.0 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir 1.3%
• CVE-2026-4066 Medium 4.3 Smart Custom Fields <= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search 0.3%
• CVE-2026-1056 Critical 9.8 Snow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal 13.3%
• CVE-2025-10137 Medium 5.4 Snow Monkey <= 29.1.5 - Unauthenticated Blind Server-Side Request Forgery 0.3%
• CVE-2024-1995 Medium 4.3 Smart Custom Fields <= 4.2.2 - Missing Authorization to Authenticated (Subscriber+) Post Content Disclosure 0.6%
• CVE-2023-6316 Critical 9.8 MW WP Form <= 5.0.1 - Unauthenticated Arbitrary File Upload 1.4%
• CVE-2023-6559 High 7.5 MW WP Form <= 5.0.3 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion 1.3%