Vulnerabilidades en PickPlugins
74 resultadosAnálisis Vexday
Com 50 CVEs catalogadas, o portfólio de vulnerabilidades da PickPlugins apresenta taxa de exploração ativa abaixo da média geral do catálogo, sem registros no CISA KEV. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), o que indica fragilidades persistentes no tratamento de entradas em suas extensões. A CVE mais perigosa ativa no momento é CVE-2021-24300, com escore EPSS de 0,1063, e há disponibilidade de PoC pública associada ao conjunto, o que eleva marginalmente o risco de tentativas oportunistas. A presença de uma CVE crítica e uma vulnerabilidade surgida nos últimos 90 dias recomenda atenção contínua ao ciclo de atualização dos plugins deste fornecedor.
CVE-2025-58827LOWWordPress Job Board Manager Plugin <= 2.1.61 - Content Injection VulnerabilityEPSS 0.2%CVE-2026-32497MEDIUMWordPress User Verification plugin <= 2.0.45 - Email Verification Bypass vulnerabilityEPSS 0.2%CVE-2025-63043MEDIUMWordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.2%CVE-2025-66058MEDIUMWordPress Post Grid and Gutenberg Blocks plugin <= 2.3.17 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2024-13469MEDIUMPricing Table by PickPlugins <= 1.12.10 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-60162MEDIUMWordPress Job Board Manager Plugin <= 2.1.61 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-65456MEDIUMWordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.2%CVE-2025-24622MEDIUMWordPress Job Board Manager plugin <= 2.1.59 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2024-12634MEDIUMRelated Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins <= 2.0.59 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-32272MEDIUMWordPress Wishlist plugin <= 1.0.46 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2025-62745MEDIUMWordPress Team Showcase plugin <= 1.22.28 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-49075MEDIUMWordPress Wishlist plugin <= 1.0.43 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-10862MEDIUMAccordions <= 2.3.23 - Authenticated (Custom+) Stored Cross-Site Scripting via Accordion Body FieldEPSS 0.2%CVE-2025-68605MEDIUMWordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%