Skip to contentStellarwp vulnerabilities
Newest
- stellarwp kadence blocks — page builder toolkit for gutenberg editorGutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' ParameterCVE-2026-18574.3 Medium
- stellarwp membership plugin – restrict contentMembership Plugin – Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice SettingsCVE-2026-13044.4 Medium
- stellarwp kadence blocks — page builder toolkit for gutenberg editorGutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing AuthorizationCVE-2026-26084.3 Medium
- stellarwp the events calendarThe Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration ControlCVE-2025-150435.4 Medium
- liquidweb restrict content, stellarwp membership plugin – restrict content +1 moreMembership Plugin – Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information ExposureCVE-2025-148448.2 High
- stellarwp the events calendarWordPress The Events Calendar plugin <= 6.15.12.2 - Broken Access Control vulnerabilityCVE-2025-693525.4 Medium
- stellarwp membership plugin – restrict contentMembership Plugin – Restrict Content <= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodesCVE-2025-140006.4 Medium
- stellarwp givewpWordPress GiveWP plugin <= 4.13.1 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2025-674675.4 Medium
- liquid web / stellarwp givewpWordPress GiveWP plugin <= 4.13.1 - Arbitrary Shortocde Execution vulnerabilityCVE-2025-665336.5 Medium
- stellarwp kadence woocommerce email designerKadence WooCommerce Email Designer <= 1.5.17 - Unauthenticated Stored Cross-Site ScriptingCVE-2025-133877.2 High
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name'CVE-2025-132067.2 High
- stellarwp bookit — booking & appointment calendarBooking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe ConnectionCVE-2025-126337.5 High
- stellarwp the events calendarThe Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information ExposureCVE-2025-121925.3 Medium
- stellarwp the events calendarThe Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via sCVE-2025-12197EPSS 18.2%7.5 High
- stellarwp the events calendarThe Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code ExposureCVE-2025-121754.3 Medium
- stellarwp event ticketsWordPress Event Tickets plugin <= 5.26.3 - Broken Access Control vulnerabilityCVE-2025-620275.4 Medium
- stellarwp wpcompleteWordPress WPComplete plugin <= 2.9.5.3 - Broken Access Control vulnerabilityCVE-2025-499065.3 Medium
- stellarwp event tickets and registrationEvent Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment BypassCVE-2025-115177.5 High
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign AssociationCVE-2025-112285.3 Medium
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns DisclosureCVE-2025-112276.5 Medium
- stellarwp wpcompleteWordPress WPComplete Plugin <= 2.9.5.2 - Cross Site Scripting (XSS) VulnerabilityCVE-2025-589746.5 Medium
- stellarwp the events calendarThe Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information DisclosureCVE-2025-98085.3 Medium
- stellarwp the events calendarThe Events Calendar <= 6.15.1 - Unauthenticated SQL InjectionCVE-2025-98077.5 High
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation UpdateCVE-2025-72214.3 Medium
- stellarwp kadence woocommerce email designerWordPress Kadence WooCommerce Email Designer Plugin <= 1.5.16 - Privilege Escalation VulnerabilityCVE-2025-546977.2 High
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data ExposureCVE-2025-86205.3 Medium
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site ScriptingCVE-2025-72055.4 Medium
- kadencewp gutenberg blocks with ai, stellarwp kadence blocks — page builder toolkit for gutenberg editor +1 moreKadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` ParameterCVE-2025-56786.4 Medium
- stellarwp wpcompleteWordPress WPComplete plugin <= 2.9.5 - Cross Site Scripting (XSS) VulnerabilityCVE-2025-500466.5 Medium
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And ModificationCVE-2025-45715.4 Medium
- stellarwp the events calendarThe Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingCVE-2025-51446.4 Medium
- stellarwp the events calendarWordPress The Events Calendar plugin <= 6.11.2.1 - Broken Access Control VulnerabilityCVE-2025-482465.4 Medium
- stellarwp the events calendarThe Events Calendar < 6.6.4 - Admin+ Stored XSSCVE-2024-84934.8 Medium
- stellarwp kadence woocommerce email designerWordPress Kadence WooCommerce Email Designer plugin <= 1.5.14 - Arbitrary File Upload vulnerabilityCVE-2025-395579.1 Critical
- stellarwp event ticketsWordPress Event Tickets plugin <= 5.20.0 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2025-307947.1 High
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information ExposureCVE-2025-23315.3 Medium
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGive <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings FunctionCVE-2025-20256.5 Medium
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object InjectionCVE-2025-09129.8 Critical
- stellarwp kadence blocks — page builder toolkit for gutenberg editorGutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon'CVE-2025-12916.4 Medium
- matt cromwell give – divi donation modulesWordPress Give – Divi Donation Modules plugin <= 2.0.0 - Sensitive Data Exposure vulnerabilityCVE-2025-226335.8 Medium
- stellarwp event tickets and registration, theeventscalendar event tickets +1 moreEvent Tickets and Registration <= 5.19.1.1 - Missing Authorization to Ticket DeletionCVE-2025-14025.3 Medium
- liquidweb event tickets, stellarwp event tickets and registration +1 moreEvent Tickets <= 5.18.1 - Insecure Direct Object Reference to Sensitive Information ExposureCVE-2024-134575.3 Medium
- learndash lms, stellarwp learndash lms +1 moreWordPress LearnDash LMS Plugin <= 4.20.0.1 - Broken Access Control vulnerabilityCVE-2025-246625.3 Medium
- stellarwp the events calendarWordPress The Events Calendar plugin <= 6.7.0 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2025-245375.4 Medium
- liquidweb restrict content, stellarwp membership plugin – restrict content +1 moreMembership Plugin – Restrict Content <= 3.2.13 - Unauthenticated Content Restriction Bypass to Sensitive Information ExposureCVE-2024-110905.3 Medium
- kadence wp gutenberg blocks by kadence blocks, kadencewp gutenberg blocks with ai +1 moreWordPress Kadence Blocks plugin <= 3.3.1 - Broken Access Control vulnerabilityCVE-2025-247534.3 Medium
- stellarwp the events calendarThe Events Calendar <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-121186.4 Medium
- givewpWordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerabilityCVE-2025-22777Public exploit9.8 Critical
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object InjectionCVE-2024-12877Public exploit9.8 Critical
- kadencewp gutenberg blocks with ai, stellarwp kadence blocks — page builder toolkit for gutenberg editor +1 moreGutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button LinkCVE-2024-123046.4 Medium
- Show moreLoading…