S
Vendor security profile
smub
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs13
Critical0
CISA KEV0
Public exploit0
Patch rate%0
Avg. CVSS6.0
12-month vulnerability rate
0
0
0
0
0
1
1
0
0
3
3
5
CVE KEV
CVE severity distribution
13toplam CVE
High2 (15%)
Medium11 (85%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%0
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
13Unknown
Latest vulnerabilities
4.7
CVE-2026-101921
WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute
S
Patch status unknownEPSS %0
7.2
CVE-2026-14335
Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters
S
Patch status unknownEPSS %0
6.5
CVE-2026-100152
All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter
S
Patch status unknownEPSS %0
6.1
CVE-2026-85492
All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname
S
Patch status unknownEPSS %0
7.2
CVE-2026-93756
Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview
S
Patch status unknownEPSS %0
6.1
CVE-2026-88996
WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter
S
Patch status unknownEPSS %0
6.4
CVE-2026-84909
Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute
S
Patch status unknownEPSS %0
6.5
CVE-2026-77189
Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute
S
Patch status unknownEPSS %0
6.4
CVE-2026-3423
Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description
S
Patch status unknownEPSS %0
6.4
CVE-2026-16775
Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
S
Patch status unknownEPSS %0