Awesomemotive vulnerabilities
Published CVEs affecting Awesomemotive products: 7 record(s), with severity, exploitation and fixes.
Easy Digital Downloads 2Duplicator 1NextGEN Gallery 1YouTube Feed Pro 1Contact Form by WPForms 1Envira Photo Gallery 1
CVE-2026-42638
High · 7.5
CWE-862 Oct 6, 2026
WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.
CVE-2026-54190
Medium · 6.5
CWE-862 Jun 16, 2026
WordPress Envira Photo Gallery plugin <= 1.12.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.
CVE-2026-48835
High · 7.5
CWE-862 Jun 15, 2026
WordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions.
CVE-2026-39503
High · 7.5
CWE-862 Jun 15, 2026
WordPress Easy Digital Downloads plugin <= 3.6.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.
CVE-2026-9059
Critical · 9.3
CWE-89 May 20, 2026
NextGEN Gallery - SQL Injection
NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums'.
The root cause is an insufficient sanitization function ('_clean_column()') in the data mapper layer that uses a character blacklist instead of a whitelist approach. This allows an authenticated attacker with the 'NextGEN Gallery overview' capability (assigned to the Administrator role by default) to inject arbitrary SQL into the 'ORDER BY' clause.
CVE-2025-12002
Medium · 5.9
CWE-22 Jan 17, 2026
Feeds for YouTube Pro <= 2.6.0 - Unauthenticated Arbitrary File Read via Path Traversal
The Feeds for YouTube Pro plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 2.6.0 via the 'sby_check_wp_submit' AJAX action. This is due to insufficient sanitization of user-supplied data and the use of that data in a file operation. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information, granted the 'Save Featured Images' setting is enabled and 'Disable WP Posts' is disabled. Note: This vulnerability only affects the Pro version of Feeds for YouTube.
CVE-2020-11738
High · 7.5
KEV Urgent · 79 Public exploit CWE-22 Apr 13, 2020
WordPress Snap Creek Duplicator Plugin File Download Vulnerability
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.