彙總 smackcoders 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
已披露問題常與 SQL 注入、CSRF與路徑處理缺陷 相關，可能在 軟體部署與生產負載 場景中帶來 工作階段劫持與檔案覆寫 等暴露風險。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2025-5692 | The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/includes/LB_admin_ajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform several actions like updating settings. Initially this CVE was assigned specifically to all AJAX actions and the doFieldAjaxAction() function, however it was deter | [email protected] | 6.3 | 0.21% | 2025-07-02 | 2025-09-30 |
| CVE-2024-12315 | The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/smack_uci_uploads/exports/ directory which can contain information like exported user data. | [email protected] | 7.5 | 0.46% | 2025-02-12 | 2025-02-25 |
| CVE-2024-9364 | The SendGrid for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_mailplus_clear_logs' function in all versions up to, and including, 1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's log files. | [email protected] | 4.3 | 0.35% | 2024-10-18 | 2024-10-22 |
| CVE-2024-43965 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders SendGrid for WordPress allows SQL Injection.This issue affects SendGrid for WordPress: from n/a through 1.4. | [email protected] | 8.2 | 1.88% | 2024-08-29 | 2024-09-04 |
| CVE-2023-2487 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1. | [email protected] | 5.9 | 0.45% | 2023-12-21 | 2026-04-28 |
| CVE-2023-45066 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1. | [email protected] | 5.9 | 0.53% | 2023-11-30 | 2026-04-28 |
| CVE-2015-10125 | A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 13c30af721d3f989caac72dd0f56cf0dc40fad7e. It is recommended to upgrade the affected component. The identifier VDB-241317 was assigned to this vulnerability. | [email protected] | 4.3 | 0.36% | 2023-10-05 | 2024-11-21 |
| CVE-2023-4142 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means remote code execution is still pos | [email protected] | 8.0 | 1.24% | 2023-08-04 | 2026-04-08 |
| CVE-2023-4141 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to create a PHP file and execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means php file cre | [email protected] | 8.0 | 1.24% | 2023-08-04 | 2026-04-08 |
| CVE-2023-4140 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction on the 'get_header_values' function. This makes it possible for authenticated attackers, with minimal permissions such as an author, if the administrator previously grants access in the plugin settings, to modify their user role by supplying the 'wp_capabilities->cus1' parameter. | [email protected] | 6.6 | 0.61% | 2023-08-04 | 2026-04-08 |
| CVE-2023-4139 | The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and including, 7.9.8. This makes it possible for unauthenticated attackers to list and view exported files. | [email protected] | 7.5 | 0.57% | 2023-08-04 | 2026-04-08 |
| CVE-2022-3860 | The Visual Email Designer for WooCommerce WordPress plugin before 1.7.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author. | [email protected] | 8.8 | 0.91% | 2023-01-02 | 2025-04-10 |
| CVE-2022-3244 | The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not have authorisation in some places, which could allow any authenticated users to access some of the plugin features if they manage to get the related nonce | [email protected] | 4.2 | 0.39% | 2022-10-17 | 2025-05-13 |
| CVE-2022-3243 | The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin | [email protected] | 7.2 | 0.99% | 2022-10-17 | 2025-05-14 |
| CVE-2022-1977 | The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks | [email protected] | 7.2 | 1.05% | 2022-06-27 | 2024-11-21 |
| CVE-2022-0360 | The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues | [email protected] | 4.8 | 0.64% | 2022-02-28 | 2024-11-21 |
| CVE-2016-11000 | The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter. | [email protected] | 9.8 | 2.13% | 2019-09-20 | 2024-11-21 |
| CVE-2016-10985 | The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter. | [email protected] | 6.1 | 1.36% | 2019-09-17 | 2024-11-21 |
| CVE-2016-10984 | The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter. | [email protected] | 6.1 | 1.36% | 2019-09-17 | 2024-11-21 |
| CVE-2018-20968 | The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF. | [email protected] | 8.8 | 0.65% | 2019-08-14 | 2024-11-21 |