Smackcoders
Products
9- 7 CVEs
- 4 CVEs
- 3 CVEs
- 2 CVEs
- 2 CVEs
- 2 CVEs
- 2 CVEs
- 1 CVE
- 1 CVE
Recent CVEs
24| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-11000 | Cri | 0.64 | 9.8 | 0.02 | Sep 20, 2019 | The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter. | ||
| CVE-2022-3860 | Hig | 0.57 | 8.8 | 0.01 | Jan 2, 2023 | The Visual Email Designer for WooCommerce WordPress plugin before 1.7.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author. | ||
| CVE-2018-20968 | Hig | 0.57 | 8.8 | 0.01 | Aug 14, 2019 | The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF. | ||
| CVE-2018-20967 | Hig | 0.57 | 8.8 | 0.01 | Aug 14, 2019 | The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF. | ||
| CVE-2024-43965 | Hig | 0.53 | 8.2 | 0.02 | Aug 29, 2024 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders SendGrid for WordPress allows SQL Injection.This issue affects SendGrid for WordPress: from n/a through 1.4. | ||
| CVE-2024-12315 | Hig | 0.49 | 7.5 | 0.00 | Feb 12, 2025 | The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated attackers to extract sensitive data… | ||
| CVE-2022-3243 | Hig | 0.47 | 7.2 | 0.01 | Oct 17, 2022 | The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin | ||
| CVE-2022-1977 | Hig | 0.47 | 7.2 | 0.01 | Jun 27, 2022 | The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks | ||
| CVE-2023-4142 | Hig | 0.45 | 8.0 | 0.02 | Aug 4, 2023 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access… | ||
| CVE-2023-4141 | Hig | 0.45 | 8.0 | 0.02 | Aug 4, 2023 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access… | ||
| CVE-2023-4139 | Hig | 0.42 | 7.5 | 0.01 | Aug 4, 2023 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and including, 7.9.8. This makes it possible for unauthenticated attackers to list and… | ||
| CVE-2025-5692 | Med | 0.41 | 6.3 | 0.00 | Jul 2, 2025 | The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/includes/LB_admin_ajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated… | ||
| CVE-2016-10985 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter. | ||
| CVE-2016-10984 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter. | ||
| CVE-2015-9306 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS. | ||
| CVE-2023-2487 | Med | 0.38 | 5.9 | 0.00 | Dec 21, 2023 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1. | ||
| CVE-2023-45066 | Med | 0.38 | 5.9 | 0.01 | Nov 30, 2023 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1. | ||
| CVE-2023-4140 | Med | 0.36 | 6.6 | 0.01 | Aug 4, 2023 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction on the 'get_header_values' function. This makes it possible for authenticated attackers, with minimal permissions such… | ||
| CVE-2022-0360 | Med | 0.31 | 4.8 | 0.01 | Feb 28, 2022 | The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues | ||
| CVE-2024-9364 | Med | 0.28 | 4.3 | 0.00 | Oct 18, 2024 | The SendGrid for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_mailplus_clear_logs' function in all versions up to, and including, 1.4. This makes it possible for authenticated attackers, with… |
- risk 0.64cvss 9.8epss 0.02
The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter.
- risk 0.57cvss 8.8epss 0.01
The Visual Email Designer for WooCommerce WordPress plugin before 1.7.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author.
- risk 0.57cvss 8.8epss 0.01
The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF.
- risk 0.57cvss 8.8epss 0.01
The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.
- risk 0.53cvss 8.2epss 0.02
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders SendGrid for WordPress allows SQL Injection.This issue affects SendGrid for WordPress: from n/a through 1.4.
- risk 0.49cvss 7.5epss 0.00
The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated attackers to extract sensitive data…
- risk 0.47cvss 7.2epss 0.01
The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin
- risk 0.47cvss 7.2epss 0.01
The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks
- risk 0.45cvss 8.0epss 0.02
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access…
- risk 0.45cvss 8.0epss 0.02
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access…
- risk 0.42cvss 7.5epss 0.01
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and including, 7.9.8. This makes it possible for unauthenticated attackers to list and…
- risk 0.41cvss 6.3epss 0.00
The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/includes/LB_admin_ajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated…
- risk 0.40cvss 6.1epss 0.01
The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.
- risk 0.40cvss 6.1epss 0.01
The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.
- risk 0.40cvss 6.1epss 0.01
The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.
- risk 0.38cvss 5.9epss 0.00
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
- risk 0.38cvss 5.9epss 0.01
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
- risk 0.36cvss 6.6epss 0.01
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction on the 'get_header_values' function. This makes it possible for authenticated attackers, with minimal permissions such…
- risk 0.31cvss 4.8epss 0.01
The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues
- risk 0.28cvss 4.3epss 0.00
The SendGrid for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_mailplus_clear_logs' function in all versions up to, and including, 1.4. This makes it possible for authenticated attackers, with…