Unknown Smart Post vulnerabilities

2 CVEs affecting Unknown Smart Post, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-78150, published 2026-09-05.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-78149, published 2026-09-05. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing…
• CVE-2026-78150, published 2026-09-05. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any…