Awesomemotive vulnerabilities, page 4

69 vulnerabilities

Known vulnerabilities in Awesomemotive products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 6 products.

7.5HighCVE-2026-48835awesomemotive · contact form by wpforms +1 moreWordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerabilityUnauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions.EPSS0.35%9.3CriticalCVE-2026-9059awesomemotive · nextgen gallery +1 moreNextGEN Gallery - SQL InjectionNextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums'. The root cause is an insufficient sanitization function ('_clean_column()') in the data mapper layer that uses a character blacklist instead of a whitelist approach. This allows an authenticated attacker with the 'NextGEN Gallery overview' capability (assigned to the Administrator role by default) to inject arbitrary SQL into the 'ORDER BY' clause.EPSS0.37%7.5HighCVE-2026-39503awesomemotive · easy_digital_downloads +1 moreWordPress Easy Digital Downloads plugin <= 3.6.5 - Broken Access Control vulnerabilityUnauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.EPSS0.35%9.8CriticalCVE-2023-40005awesomemotive · easy_digital_downloads +2 moreWordPress Easy Digital Downloads plugin <= 3.1.5 - Broken Access ControlMissing Authorization vulnerability in Syed Balkhi Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through <= 3.1.5.EPSS0.64%6.5MediumCVE-2023-51684awesomemotive · easy_digital_downloads +2 moreWordPress Easy Digital Downloads Plugin <= 3.2.5 is vulnerable to Cross Site Scripting (XSS)Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Digital Downloads Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) allows Stored XSS.This issue affects Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy): from n/a through 3.2.5.EPSS0.33%9.8CriticalCVE-2023-30869awesomemotive · easy_digital_downloads +2 moreWordPress Easy Digital Downloads Plugin 3.1-3.1.1.4.1 is vulnerable to Privilege EscalationImproper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1.EPSS3.10%9.8CriticalCVE-2023-6114awesomemotive · duplicator +4 moreDuplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data ExposureThe Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.EPSS30.89%7.2HighCVE-2023-3081awesomemotive · wp_mail_logging +2 moreWP Mail Logging <= 1.11.1 - Unauthenticated Stored Cross-Site Scripting via EmailThe WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: An incomplete fix was released in 1.11.1.EPSS0.65%7.1HighCVE-2023-33309awesome motive · duplicator pro +2 moreWordPress Duplicator Pro Plugin <= 4.5.11 is vulnerable to Cross Site Scripting (XSS)Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Awesome Motive Duplicator Pro plugin <= 4.5.11 versions.EPSS0.38%