smub vulnerabilities

CVEs per yearBy the year they were published

1. 20238
2. 202436
3. 202526
4. 202644

Newest CVEs

• CVE-2026-120538

  Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture

  smub · Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

  High8.1
• CVE-2026-76010

  Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal

  smub · Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

  High8.8
• CVE-2026-109367

  All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter

  smub · All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

  Medium5.3
• CVE-2026-116563

  Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML

  smub · Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

  Medium5.4
• CVE-2026-76012

  Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload

  smub · Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

  High7.5
• CVE-2026-82814

  Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection

  smub · Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

  High8.8
• CVE-2026-109401

  WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email

  smub · WP Mail Logging

  Low2.7
• CVE-2026-97640

  WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)

  smub · WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)

  High7.2
• CVE-2026-101921

  WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute

  smub · WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

  Medium4.7
• CVE-2026-14335

  Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters

  smub · Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

  High7.2