smub Vulnerabilities and Affected Products

Products

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy15 vulnerabilities
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More8 vulnerabilities
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic7 vulnerabilities
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery7 vulnerabilities
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More6 vulnerabilities
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More6 vulnerabilities
Sydney Toolbox5 vulnerabilities
aThemes Addons for Elementor4 vulnerabilities
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)4 vulnerabilities
Custom Twitter Feeds – A Tweets Widget or X Feed Widget3 vulnerabilities
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers3 vulnerabilities
Smash Balloon Social Photo Feed – Easy Social Feeds Plugin3 vulnerabilities
UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds3 vulnerabilities
Contact Form & SMTP Plugin for WordPress by PirateForms2 vulnerabilities
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more2 vulnerabilities
Feeds for YouTube (YouTube video, channel, and gallery plugin)2 vulnerabilities
Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More2 vulnerabilities
WP Mail Logging2 vulnerabilities
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More2 vulnerabilities
aThemes Starter Sites1 vulnerability
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More1 vulnerability
PDF Embedder1 vulnerability
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation1 vulnerability
Slider by Soliloquy – Responsive Image Slider for WordPress1 vulnerability
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress1 vulnerability

smub vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-10038MEDIUM	Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insecure Direct Object Reference / Authorization Bypass leading to Arbitrary Attachment Deletion in versions up to, and including, 1.8.11.1 via the profile avatar update flow. This is due to the save_avatar() function in Charitable_Profile_Form calling wp_delete_attachment() on an attachment ID read from the user's 'avatar' meta without validating that the attachment… CWE-639Jun 5, 2026	CVSS4.3v3.1	EPSS0.285%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-7619MEDIUM	Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 1.8.10.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with access to the donation management admin area (requiring the edit_others_donations capability) and a… CWE-89May 13, 2026	CVSS6.5v3.1	EPSS0.281%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-3177MEDIUM	Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 1.8.9.7. This is due to missing cryptographic verification of incoming Stripe webhook events. This makes it possible for unauthenticated attackers to forge payment_intent.succeeded webhook payloads and mark pending donations as completed without a real payment. CWE-345Apr 7, 2026	CVSS5.3v3.1	EPSS0.166%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-11893MEDIUM	Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to SQL Injection via the donation_ids parameter in all versions up to, and including, 1.8.8.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries … CWE-89Oct 25, 2025	CVSS6.5v3.1	EPSS0.353%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-5275MEDIUM	Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affect… CWE-79Jun 26, 2025	CVSS4.4v3.1	EPSS0.181%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-10876MEDIUM	Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.8.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CWE-79Nov 9, 2024	CVSS6.1v3.1	EPSS0.36%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-8791CRITICAL	Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.8.1.14. This is due to the plugin not properly verifying a user's identity when the ID parameter is supplied through the update_core_user() function. This makes it possible for unauthenticated attackers to update the email address and password of arbitrary user accounts, including administrators, which can then… CWE-639Sep 24, 2024	CVSS9.8v3.1	EPSS0.733%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-4404CRITICAL	Donation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege Escalation The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient restriction on the 'update_core_user' function. This makes it possible for unauthenticated attackers to specify their user role by supplying the 'role' parameter during a registration. CWE-269Aug 23, 2023	CVSS9.8v3.1	EPSS0.765%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX