smub Vulnerabilities and Affected Products
Vulnerabilities associated with UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds.
Products
Clear product- Easy Digital Downloads – eCommerce Payments and Subscriptions made easy15 vulnerabilities
- Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More8 vulnerabilities
- All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic7 vulnerabilities
- Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery7 vulnerabilities
- Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More6 vulnerabilities
- WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More6 vulnerabilities
- Sydney Toolbox5 vulnerabilities
- aThemes Addons for Elementor4 vulnerabilities
- ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)4 vulnerabilities
- Custom Twitter Feeds – A Tweets Widget or X Feed Widget3 vulnerabilities
- Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers3 vulnerabilities
- Smash Balloon Social Photo Feed – Easy Social Feeds Plugin3 vulnerabilities
- UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds3 vulnerabilities
- Contact Form & SMTP Plugin for WordPress by PirateForms2 vulnerabilities
- Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more2 vulnerabilities
- Feeds for YouTube (YouTube video, channel, and gallery plugin)2 vulnerabilities
- Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More2 vulnerabilities
- WP Mail Logging2 vulnerabilities
- WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More2 vulnerabilities
- aThemes Starter Sites1 vulnerability
- Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More1 vulnerability
- PDF Embedder1 vulnerability
- Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation1 vulnerability
- Slider by Soliloquy – Responsive Image Slider for WordPress1 vulnerability
- Smash Balloon Social Post Feed – Simple Social Feeds for WordPress1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-10694MEDIUM | User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.8.0 - Missing Authorization to Information DisclosureThe User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `maybe_load_onboarding_wizard` function in all versions up to, and including, 1.8.0. This makes it possible for unauthenticated attackers to access the onboarding wizard page and view configuration information including the administrator email address. CWE-862Oct 25, 2025 | CVSS5.3v3.1 | EPSS0.238% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-5902HIGH | UserFeedback Lite <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Name ParameterThe User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name parameter in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in feedback form responses that will execute whenever a high-privileged user tries to view them. CWE-79Jul 12, 2024 | CVSS7.2v3.1 | EPSS0.395% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-0903MEDIUM | User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.0.13 - Unauthenticated Stored Cross-Site ScriptingThe User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_submitted' 'link' value in all versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the feedback submission page that will execute when a user clicks the link, while also pressing the command key. CWE-79Feb 22, 2024 | CVSS5.4v3.1 | EPSS0.438% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |