Vulnerabilities

TI-2026-02216 CVE-2026-2594 · GHSA-xpfv-qr3c-jw2p

Smart Custom Fields <= 5.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title

LOW 28

The Smart Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.7.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00321 Published 2026-07-17 No fix listed CWE-79

TI-2026-02593 CVE-2026-3004

Snow Monkey Blocks <= 24.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' Attribute

LOW 28

The Snow Monkey Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-slick' attribute in all versions up to, and including, 24.1.11 due to insufficient input sanitization and output esca…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00188 Published 2026-05-13 No fix listed CWE-79

TI-2026-04759 CVE-2026-5436 · GHSA-44gv-5x3q-67mm

MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys

LOW 39

The MW WP Form plugin for WordPress is vulnerable to Arbitrary File Move/Read in all versions up to and including 5.1.1.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01088 Published 2026-04-08 No fix listed CWE-22

TI-2026-03783 CVE-2026-4347 · GHSA-2mhf-8wh4-g2p3

MW WP Form <= 5.1.0 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir

MEDIUM 40

The MW WP Form plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the 'generate_user_filepath' function and the 'move_temp_file_to_upload_dir' function in all version…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01295 Published 2026-04-02 No fix listed CWE-22

TI-2026-03521 CVE-2026-4066 · GHSA-v295-3wx7-pwm2

Missing authorization in inc2734 Smart Custom Fields

LOW 20

The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() function in all versions up to, and including, 5.0.6.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.003 Published 2026-03-23 No fix listed CWE-862

TI-2026-00790 CVE-2026-1056 · GHSA-g5p3-f4cq-94v5

Snow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal

MEDIUM 57

The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to, and including, 12.0.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.13284 Published 2026-01-28 No fix listed CWE-22

TI-2025-09309 CVE-2025-10137 · GHSA-v2p8-6vvr-34m3

Snow Monkey <= 29.1.5 - Unauthenticated Blind Server-Side Request Forgery

LOW 24

The Snow Monkey theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 29.1.5 via the request() function.

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00276 Published 2025-09-26 No fix listed CWE-918

TI-2024-01856 CVE-2024-1995 · GHSA-32p2-vr3j-c4gw

Smart Custom Fields <= 4.2.2 - Missing Authorization to Authenticated (Subscriber+) Post Content Disclosure

LOW 21

The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() function in all versions up to, and including, 4.2.2.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00576 Published 2024-03-20 No fix listed CWE-862

Vulnerabilities

Filters