Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

16 records

Vendor: SmartDataSoft Clear all filters
TI-2020-19107 CVE-2020-36972 · GHSA-h5jp-4qg2-hm8r

SmartBlog 2.0.1 - 'id_post' Blind SQL injection

Priority HIGH 77

SmartBlog 2.0.1 contains a blind SQL injection vulnerability in the 'id_post' parameter of the details controller that allows attackers to extract database information.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00335 Published 2026-01-28 No fix listed CWE-89
TI-2026-17940 CVE-2026-22358 · GHSA-vf62-mr8q-5x6j

WordPress Electrician - Electrical Service WordPress theme <= 5.6 - Server Side Request Forgery (SSRF) vulnerability

Priority LOW 24

Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Electrician - Electrical Service WordPress electrician allows Server Side Request Forgery.This issue affects Electrician - Electrical Service WordPress: f…

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00204 Published 2026-01-22 No fix listed CWE-918
TI-2025-35856 CVE-2025-58004 · GHSA-4qmq-8rcf-xwvr

WordPress DriCub Theme <= 2.9 - Broken Access Control Vulnerability

Priority LOW 30

Missing Authorization vulnerability in SmartDataSoft DriCub dricub-driving-school allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DriCub: from n/a through <= 2.9.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00265 Published 2025-09-22 No fix listed CWE-862
TI-2025-06361 CVE-2025-6994 · GHSA-6mvg-hp5v-5gx7

Reveal Listing <= 3.3 - Unauthenticated Privilege Escalation

Priority MEDIUM 42

The Reveal Listing plugin by smartdatasoft for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00467 Published 2025-08-06 No fix listed CWE-269
TI-2024-11798 CVE-2024-12725 · GHSA-69xj-9qh4-v9hv

Clasify Classified Listing <= 1.0.7 - Reflected XSS

Priority MEDIUM 60

The Clasify Classified Listing WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high p…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00346 Published 2025-05-15 No fix listed CWE-79
TI-2025-01099 CVE-2025-1285 · GHSA-vf6c-xwj3-3r3v

Missing authorization in SmartDataSoft Resido - Real Estate WordPress Theme

Priority LOW 30

The Resido - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the delete_api_key and save_api_key AJAX actions in all versions up to, and including…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0028 Published 2025-03-14 No fix listed CWE-862
TI-2025-17624 CVE-2025-23857 · GHSA-8qrq-ggw5-w3f4

WordPress Essential WP Real Estate Plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SmartDataSoft Essential WP Real Estate essential-wp-real-estate allows Reflected XSS.This issue affects Essential WP R…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00255 Published 2025-02-14 No fix listed CWE-79
TI-2024-12390 CVE-2024-13347 · GHSA-6qgj-99vr-vrh7

Essential WP Real Estate <= 1.1.3 - Reflected XSS

Priority MEDIUM 63

The Essential WP Real Estate WordPress plugin through 1.1.3 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00595 Published 2025-02-03 No fix listed CWE-79
TI-2021-15428 CVE-2021-37538 · GHSA-8v9p-7c45-26j2

Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before…

Priority HIGH 81

Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL commands via the day, month, or year parameter to the controll…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.74489 Published 2021-08-24 No fix listed CWE-89
TI-2021-06627 CVE-2021-24335 · GHSA-jwxh-4hx3-7c3f

Car Repair Services < 4.0 - Unauthenticated Reflected XSS & XFS

Priority LOW 34

The Car Repair Services & Auto Mechanic WordPress theme before 4.0 did not properly sanitise its serviceestimatekey search parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issu…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.03884 Published 2021-06-01 Fixed in 4.0 CWE-79