Vulnerabilidades em roxnor
80 resultadosAnálise Vexday
Com 61 CVEs catalogadas e nenhuma entrada confirmada no catálogo KEV da CISA, o perfil de exploração ativa da Roxnor situa-se abaixo da média geral do catálogo. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão que tipicamente favorece ataques do lado do cliente e pode ser subestimado em triagens focadas apenas em severidade. A CVE mais relevante no momento é CVE-2023-0084, que apresenta o maior EPSS observado no portfólio (0,2857), indicando probabilidade não negligenciável de exploração mesmo sem confirmação ativa. A presença de uma PoC pública e três vulnerabilidades surgidas nos últimos 90 dias recomenda monitoramento contínuo, especialmente para equipes que dependem de patches recentes.
CVE-2024-1585MEDIUMMetform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2025-48302HIGHWordPress FundEngine Plugin <= 1.7.4 - Local File Inclusion VulnerabilityEPSS 0.5%CVE-2024-21746MEDIUMWordPress Wp Ultimate Review plugin <= 2.3.6 - IP limit Bypass vulnerabilityEPSS 0.5%CVE-2025-0968MEDIUMElementsKit Elementor addons <= 3.4.0 - Unauthenticated Information Exposure via get_megamenu_content FunctionEPSS 0.5%CVE-2024-2042MEDIUMElementsKit Elementor addons <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion WidgetEPSS 0.5%CVE-2023-0689MEDIUMMetform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcodeEPSS 0.5%CVE-2024-1763MEDIUMWp Social Login and Register Social Counter <= 3.0.0 - Missing Authorization to Unauthenticated Social Login/Share Status UpdateEPSS 0.4%CVE-2024-33570MEDIUMWordPress MetForm plugin <= 3.8.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-6525MEDIUMElementsKit Elementor addons <= 3.0.3 - Authenticated(Editor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-6698HIGHFundEngine – Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege EscalationEPSS 0.4%CVE-2024-8546MEDIUMElementsKit Elementor addons <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video WidgetEPSS 0.4%CVE-2023-0695MEDIUMMetform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcodeEPSS 0.4%CVE-2023-2517MEDIUMMetform Elementor Contact Form Builder <= 3.3.2 - Cross-Site Request Forgery via permalink_setupEPSS 0.4%CVE-2025-13192HIGHPopup builder with Gamification <= 2.2.0 - Unauthenticated SQL Injection via Multiple REST API EndpointsEPSS 0.4%CVE-2026-3474MEDIUMEmailKit <= 1.6.3 - Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API ParameterEPSS 0.4%CVE-2024-6455MEDIUMElementsKit Elementor addons <= 3.2.0 - Unauthenticated Information Exposure via ekit_widgetarea_content FunctionEPSS 0.4%CVE-2023-0710MEDIUMMetform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcodeEPSS 0.4%CVE-2026-23693CRITICALElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST EndpointEPSS 0.4%CVE-2024-1239MEDIUMElementsKit Elementor addons <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-14314HIGHWordPress PopupKit plugin <= 2.1.5 - SQL Injection vulnerabilityEPSS 0.4%