Vulnerabilidades de Awesomemotive
CVEs publicadas que afetam produtos de Awesomemotive: 7 registro(s), com severidade, exploração e correções.
Easy Digital Downloads 2Duplicator 1NextGEN Gallery 1YouTube Feed Pro 1Contact Form by WPForms 1Envira Photo Gallery 1
CVE-2026-42638
Alta · 7.5
CWE-862 06/10/2026
WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.
CVE-2026-54190
Média · 6.5
CWE-862 16/06/2026
WordPress Envira Photo Gallery plugin <= 1.12.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.
CVE-2026-48835
Alta · 7.5
CWE-862 15/06/2026
WordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions.
CVE-2026-39503
Alta · 7.5
CWE-862 15/06/2026
WordPress Easy Digital Downloads plugin <= 3.6.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.
CVE-2026-9059
Crítica · 9.3
CWE-89 20/05/2026
NextGEN Gallery: injeção de SQL pelo parâmetro orderby da API REST
A NextGEN Gallery em versões anteriores à 4.2.1 é vulnerável a injeção de SQL autenticada através do parâmetro 'orderby' nos endpoints da API REST '/imagely/v1/galleries' e '/imagely/v1/albums'. A causa raiz é uma função de sanitização insuficiente ('_clean_column()') na camada de data mapper, que usa uma lista negra de caracteres em vez de uma lista branca. Isso permite que um atacante autenticado com a capacidade 'NextGEN Gallery overview' (atribuída ao perfil Administrator por padrão) injete SQL arbitrário na cláusula 'ORDER BY'.
CVE-2025-12002
Média · 5.9
CWE-22 17/01/2026
Feeds for YouTube Pro <= 2.6.0 - Unauthenticated Arbitrary File Read via Path Traversal
The Feeds for YouTube Pro plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 2.6.0 via the 'sby_check_wp_submit' AJAX action. This is due to insufficient sanitization of user-supplied data and the use of that data in a file operation. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information, granted the 'Save Featured Images' setting is enabled and 'Disable WP Posts' is disabled. Note: This vulnerability only affects the Pro version of Feeds for YouTube.
CVE-2020-11738
Alta · 7.5
KEV Urgente · 79 Exploit público CWE-22 13/04/2020
WordPress Snap Creek Duplicator Plugin File Download Vulnerability
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.