Log in Start free

smub

Products

ProductCVEsExploitedLatest
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy17–Nov 3, 2026
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery10–Oct 31, 2026
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More8–Jun 5, 2026
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic7–May 20, 2026
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More7–Aug 28, 2026
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More6–Jun 6, 2026
Sydney Toolbox5–May 14, 2024
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More4–Oct 10, 2026
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)4–Apr 24, 2026
aThemes Addons for Elementor4–Jun 10, 2026
Custom Twitter Feeds – A Tweets Widget or X Feed Widget4–Sep 18, 2026
WP Mail Logging3–Oct 16, 2026
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress3–Oct 2, 2026
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers3–Nov 19, 2025
UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds3–Oct 25, 2025
Smash Balloon Social Photo Feed – Easy Social Feeds Plugin3–Aug 5, 2026
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)3–Oct 31, 2026
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More2–Oct 21, 2026
Feeds for YouTube (YouTube video, channel, and gallery plugin)2–Jul 11, 2024
Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More2–Aug 27, 2024
Slider by Soliloquy – Responsive Image Slider for WordPress1–May 22, 2026
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)1–Sep 1, 2026
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more1–Jun 13, 2024
aThemes Starter Sites1–Jul 27, 2024
PDF Embedder – PDF Viewer & Embed PDF Files for WordPress1–May 28, 2026
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation1–May 25, 2024
Contact Form & SMTP Plugin for WordPress by PirateForms1–Jan 30, 2025
Sugar Calendar – Events Calendar, Event Tickets, and Events Management Platform1–Nov 26, 2024
Transients Manager1–Oct 23, 2024
WP Lightbox 21–Jul 3, 2024
WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin1–Jul 20, 2024
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager1–May 27, 2026
WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)1–Oct 16, 2026

Exploited and recent CVEs

  • CVE-2026-120538 High 8.1 Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture 0.4%
  • CVE-2026-76010 High 8.8 Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal 0.8%
  • CVE-2026-109367 Medium 5.3 All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter 0.3%
  • CVE-2026-116563 Medium 5.4 Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML 0.4%
  • CVE-2026-76012 High 7.5 Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload 0.8%
  • CVE-2026-82814 High 8.8 Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection 0.7%
  • CVE-2026-109401 Low 2.7 WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email 0.3%
  • CVE-2026-97640 High 7.2 WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) 0.2%
  • CVE-2026-101921 Medium 4.7 WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute 0.3%
  • CVE-2026-14335 High 7.2 Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters 0.2%
  • CVE-2026-100152 Medium 6.5 All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter 0.4%
  • CVE-2026-85492 Medium 6.1 All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname 0.2%
  • CVE-2026-93756 High 7.2 Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview 0.3%
  • CVE-2026-88996 Medium 6.1 WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter 0.4%
  • CVE-2026-84909 Medium 6.4 Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute 0.4%
  • CVE-2026-77189 Medium 6.5 Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute 0.5%
  • CVE-2026-3423 Medium 6.4 Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description 0.3%
  • CVE-2026-16775 Medium 6.4 Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute 0.3%
  • CVE-2026-15452 Medium 4.7 Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String 0.4%
  • CVE-2026-12476 High 7.2 Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter 1.2%
  • CVE-2026-15782 Medium 4.9 WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content 0.3%
  • CVE-2026-12002 Medium 4.7 Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter 0.1%
  • CVE-2026-12127 Medium 5.3 WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name 0.6%
  • CVE-2026-8613 Medium 6.4 aThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Setting 0.2%
  • CVE-2026-7792 Medium 5.3 WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint 0.3%
  • CVE-2026-10038 Medium 4.3 Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter 0.3%
  • CVE-2026-7526 Medium 4.3 PDF Embedder <= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Page 0.4%
  • CVE-2026-7533 Medium 4.3 Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter 0.1%
  • CVE-2026-8832 High 8.8 WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost 1.9%
  • CVE-2026-7636 Medium 4.3 Slider by Soliloquy <= 2.8.1 - Authenticated (Subscriber+) Information Disclosure via REST API Endpoint 0.2%