Roxnor vulnerabilities

Products

• Metform – Contact Form, Survey, Quiz, & Custom Form Builder For Elementor 23
• Elementskit Elementor Addons – Advanced Widgets & Templates Addons For Elementor 19
• Wp Ultimate Review 17
• Elementskit Elementor Addons Lite 7
• Wp Social Login And Register Social Counter 7
• Fundengine 6
• Popup Builder With Gamification, Multi-step Popups, Page-level Targeting, And Woocommerce Triggers 5
• Emailkit – Email Customizer For Woocommerce & Wp 4
• Getgenie 4
• Fundengine – Donation And Crowdfunding Platform 3
• Getgenie – Ai Content Writer With Keyword Research & Seo Tracking Tools 3
• Metform 3
• Shopengine Elementor Woocommerce Builder Addon – All In One Woocommerce Solution 3
• Popupkit 2

Newest

• roxnor wp social login and register social counter Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback CVE-2026-103898 8.1 HighOctober 31, 2026
• roxnor rox appointment booking – event, calendar & appointment scheduling Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint CVE-2026-104012 8.8 HighOctober 31, 2026
• roxnor wp ultimate review WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email CVE-2026-103234 4.8 MediumOctober 22, 2026
• roxnor wp ultimate review WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode) CVE-2026-100157 6.5 MediumOctober 3, 2026
• roxnor wp ultimate review WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter CVE-2026-103519 5.4 MediumOctober 3, 2026
• roxnor wp ultimate review WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings CVE-2026-101162 Public exploit 6.4 MediumOctober 3, 2026
• roxnor wp ultimate review WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode CVE-2026-101161 Public exploit 7.5 HighOctober 3, 2026
• roxnor wp ultimate review WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating CVE-2026-101160 Public exploit 7.5 HighOctober 3, 2026
• roxnor wp ultimate review WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission CVE-2026-101159 7.5 HighOctober 3, 2026
• roxnor wp social login and register social counter Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write CVE-2026-97344 6.4 MediumOctober 3, 2026
• roxnor elementskit elementor addons lite WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability CVE-2026-103063 6.5 MediumOctober 1, 2026
• roxnor elementskit elementor addons lite WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability CVE-2026-103064 6.5 MediumOctober 1, 2026
• roxnor elementskit elementor addons lite WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-94500 6.5 MediumSeptember 23, 2026
• roxnor wp ultimate review WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter CVE-2026-92235 8.1 HighSeptember 22, 2026
• roxnor shopengine elementor woocommerce builder addon – all in one woocommerce solution with ecommerce templates & woo widgets The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sh… CVE-2026-85575 6.4 MediumSeptember 15, 2026
• roxnor shopengine elementor woocommerce builder addon – all in one woocommerce solution with ecommerce templates & woo widgets ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes CVE-2026-75971 7.2 HighAugust 25, 2026
• roxnor metform – contact form, survey, quiz, conditional forms, form templates & custom form builder for elementor MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting CVE-2026-18100 6.4 MediumAugust 25, 2026
• roxnor fundengine – donation and crowdfunding platform FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter CVE-2026-76063 6.4 MediumAugust 25, 2026
• roxnor fundengine – donation and crowdfunding platform FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter CVE-2026-75930 4.3 MediumAugust 25, 2026
• roxnor fundengine WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability CVE-2026-73993 9.8 CriticalAugust 20, 2026
• roxnor fundengine WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability CVE-2026-32470 9.8 CriticalAugust 18, 2026
• roxnor getgenie WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability CVE-2026-65440 7.1 HighJuly 27, 2026
• roxnor fundengine WordPress FundEngine plugin <= 1.7.8 - Broken Access Control vulnerability CVE-2026-59560 6.5 MediumJuly 27, 2026
• roxnor fundengine WordPress FundEngine plugin <= 1.7.6 - Broken Access Control vulnerability CVE-2026-57406 6.5 MediumJuly 13, 2026
• roxnor getgenie WordPress GetGenie plugin <= 4.4.2 - Sensitive Data Exposure vulnerability CVE-2026-57316 6.5 MediumJune 26, 2026
• roxnor getgenie WordPress GetGenie plugin <= 4.4.1 - Sensitive Data Exposure vulnerability CVE-2026-54197 6.5 MediumJune 16, 2026
• roxnor elementskit elementor addons lite WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability CVE-2026-49053 5.3 MediumMay 27, 2026
• roxnor elementskit elementor addons lite WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability CVE-2026-49052 4.3 MediumMay 27, 2026
• roxnor elementskit elementor addons – advanced widgets & templates addons for elementor ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite CVE-2026-4362 6.5 MediumMay 5, 2026
• roxnor emailkit – email customizer for woocommerce & wp EmailKit <= 1.6.5 - Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter CVE-2026-5957 6.5 MediumMay 5, 2026
• roxnor wp ultimate review WordPress Wp Ultimate Review plugin <= 2.3.8 - Broken Access Control vulnerability CVE-2026-39644 5.3 MediumApril 8, 2026
• roxnor elementskit elementor addons – advanced widgets & templates addons for elementor ElementsKit Elementor Addons and Templates <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget CVE-2026-2600 Public exploit 6.4 MediumApril 4, 2026
• roxnor emailkit – email customizer for woocommerce & wp EmailKit <= 1.6.3 - Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter CVE-2026-3474 4.9 MediumMarch 20, 2026
• roxnor getgenie – ai content writer with keyword research & seo tracking tools GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion CVE-2026-2879 5.4 MediumMarch 13, 2026
• roxnor getgenie – ai content writer with keyword research & seo tracking tools GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API CVE-2026-2257 6.4 MediumMarch 13, 2026
• roxnor elementskit elementor addons – advanced widgets & templates addons for elementor ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint CVE-2026-23693 9.3 CriticalFebruary 23, 2026
• roxnor emailkit – email customizer for woocommerce & wp EmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification CVE-2026-1925 4.3 MediumFebruary 18, 2026
• roxnor popup builder with gamification, multi-step popups, page-level targeting, and woocommerce triggers PopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion CVE-2025-14895 5.4 MediumFebruary 10, 2026
• roxnor popup builder with gamification, multi-step popups, page-level targeting, and woocommerce triggers Popup builder with Gamification <= 2.2.0 - Unauthenticated SQL Injection via Multiple REST API Endpoints CVE-2025-13192 8.2 HighFebruary 4, 2026
• roxnor metform – contact form, survey, quiz, & custom form builder for elementor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value CVE-2026-0633 3.7 LowJanuary 24, 2026
• roxnor getgenie WordPress GetGenie plugin <= 4.3.0 - Broken Access Control vulnerability CVE-2026-24356 4.9 MediumJanuary 22, 2026
• roxnor getgenie – ai content writer with keyword research & seo tracking tools GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools <= 4.3.0 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion CVE-2026-1003 4.3 MediumJanuary 16, 2026
• roxnor emailkit – email customizer for woocommerce & wp EmailKit <= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path Traversal CVE-2025-14059 6.5 MediumJanuary 7, 2026
• roxnor popup builder with gamification, multi-step popups, page-level targeting, and woocommerce triggers Popupkit <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Subscriber Data Deletion CVE-2025-14441 4.3 MediumJanuary 6, 2026
• roxnor popupkit WordPress PopupKit plugin <= 2.1.5 - Sensitive Data Exposure vulnerability CVE-2025-69026 4.3 MediumDecember 30, 2025
• roxnor popupkit WordPress PopupKit plugin <= 2.1.5 - SQL Injection vulnerability CVE-2025-14314 8.5 HighDecember 18, 2025
• roxnor wp ultimate review WordPress Wp Ultimate Review plugin <= 2.3.7 - Cross Site Scripting (XSS) vulnerability CVE-2025-63057 6.5 MediumDecember 9, 2025
• roxnor wp social login and register social counter Wp Social Login and Register Social Counter <= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tampering CVE-2025-13620 5.3 MediumDecember 5, 2025
• roxnor shopengine elementor woocommerce builder addon – all in one woocommerce solution ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation CVE-2025-12358 4.3 MediumDecember 3, 2025
• roxnor shopengine elementor woocommerce builder addon – all in one woocommerce solution ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update CVE-2025-11888 2.7 LowOctober 25, 2025
• Show olderLoading…