inc2734 vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20242
3. 20251
4. 20266

Newest CVEs

• CVE-2026-2594

  Smart Custom Fields <= 5.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title

  inc2734 · Smart Custom Fields

  Medium6.4
• CVE-2026-3004

  Snow Monkey Blocks <= 24.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' Attribute

  inc2734 · Snow Monkey Blocks

  Medium6.4
• CVE-2026-5436

  MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys

  inc2734 · MW WP Form

  High8.1
• CVE-2026-4347

  MW WP Form <= 5.1.0 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir

  inc2734 · MW WP Form

  High8.1
• CVE-2026-4066

  Smart Custom Fields <= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search

  inc2734 · Smart Custom Fields

  Medium4.3
• CVE-2026-1056

  Snow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal

  inc2734 · Snow Monkey Forms

  Critical9.8
• CVE-2025-10137

  Snow Monkey <= 29.1.5 - Unauthenticated Blind Server-Side Request Forgery

  inc2734 · Snow Monkey

  Medium5.4
• CVE-2024-1995

  Smart Custom Fields <= 4.2.2 - Missing Authorization to Authenticated (Subscriber+) Post Content Disclosure

  inc2734 · Smart Custom Fields

  Medium4.3
• CVE-2023-6316

  MW WP Form <= 5.0.1 - Unauthenticated Arbitrary File Upload

  inc2734 · MW WP Form

  Critical9.8
• CVE-2023-6559

  MW WP Form <= 5.0.3 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion

  inc2734 · MW WP Form

  High7.5