Vulnerabilidades em shapedplugin
12 resultadosAnálise Vexday
ShapedPlugin apresenta 9 vulnerabilidades catalogadas, com 3 divulgadas nos últimos 90 dias, indicando atividade recente de descoberta. Nenhuma vulnerabilidade está sob ataque ativo (KEV) e não há críticas CVSS, reduzindo a severidade imediata. A fraqueza dominante é CWE-79 (injeção de conteúdo em páginas web/cross-site scripting), típica de plugins e requerendo atenção em contextos onde dados não-confiáveis são processados.
CVE-2024-3020HIGHCarousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Admin+) PHP Object InjectionEPSS 1.0%CVE-2026-3017HIGHSmart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object InjectionEPSS 0.5%CVE-2024-5020MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript LibraryEPSS 0.4%CVE-2024-1363MEDIUMEasy Accordion – Best Accordion FAQ Plugin for WordPress <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-2949MEDIUMCarousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sp_wp_carousel_shortcode'EPSS 0.3%CVE-2024-32801MEDIUMWordPress Widget Post Slider plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-4665MEDIUMWP Carousel Free <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' AttributeEPSS 0.3%CVE-2026-18988MEDIUMEasy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block AttributeEPSS 0.3%CVE-2023-25065MEDIUMWordPress WP Tabs Plugin <= 2.1.14 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2025-12584MEDIUMQuick View for WooCommerce <= 2.2.17 - Unauthenticated Private Product DisclosureEPSS 0.2%CVE-2026-7249MEDIUMLocation Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache PurgingEPSS 0.2%CVE-2026-15652MEDIUMEasy Accordion <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block AttributeEPSS 0.2%