Skip to contentStellarwp vulnerabilities
Newest
- stellarwp learndash lmsLearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST EndpointCVE-2026-128435.4 Medium
- stellarwp the events calendarThe Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST APICVE-2026-847452.7 Low
- stellarwp learndash lmsLearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload HandlerCVE-2026-124837.5 High
- liquid web / stellarwp givewpWordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerabilityCVE-2026-82222Public exploit10.0 Critical
- stellarwp givewp – donation plugin and fundraising platformGiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesCVE-2026-55106.4 Medium
- nexcess the events calendarWordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerabilityCVE-2026-782659.8 Critical
- nexcess event ticketsWordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-782637.1 High
- liquid web / stellarwp wpcompleteWordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-665997.1 High
- nexcess givewpWordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerabilityCVE-2026-733526.5 Medium
- nexcess givewpWordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerabilityCVE-2026-733486.5 Medium
- nexcess givewpWordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-733576.5 Medium
- nexcess givewpWordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerabilityCVE-2026-733495.3 Medium
- nexcess givewpWordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-666907.1 High
- nexcess kadence woocommerce email designerWordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerabilityCVE-2026-280059.8 Critical
- stellarwp membership plugin – kadence membershipsMembership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account TakeoverCVE-2026-92739.3 Critical
- stellarwp kadence blocks — page builder toolkit for gutenberg editorKadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block AttributeCVE-2026-184356.4 Medium
- stellarwp kadence blocks — page builder toolkit for gutenberg editorKadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image ContentCVE-2026-180626.4 Medium
- stellarwp givewpGiveWP < 4.16.3 - Unauthenticated Recurring Donor Information DisclosureCVE-2026-143197.5 High
- stellarwp givewpGiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction BypassCVE-2026-143175.3 Medium
- stellarwp givewpGiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template SettingsCVE-2026-143186.8 Medium
- nexcess givewpWordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-654417.1 High
- nexcess event ticketsWordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerabilityCVE-2026-655675.3 Medium
- stellarwp the events calendarThe Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status ManipulationCVE-2026-133905.3 Medium
- nexcess givewpWordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2026-654645.4 Medium
- stellarwp givewp – donation plugin and fundraising platformGiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template SettingCVE-2026-149876.4 Medium
- nexcess event ticketsWordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerabilityCVE-2026-577057.5 High
- stellarwp kadence blocks — page builder toolkit for gutenberg editorGutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post PublicationCVE-2026-152864.3 Medium
- stellarwp givewp – donation plugin and fundraising platformGiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa FormCVE-2026-137046.4 Medium
- stellarwp givewp – donation plugin and fundraising platformGiveWP <= 4.15.3 - Cross-Site Request ForgeryCVE-2026-119814.3 Medium
- stellarwp kadence blocks — page builder toolkit for gutenberg editorKadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX ActionsCVE-2026-129024.3 Medium
- stellarwp kadence blocks — page builder toolkit for gutenberg editorKadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' ParameterCVE-2026-129044.3 Medium
- stellarwp givewp – donation plugin and fundraising platformGiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode AttributeCVE-2026-132466.4 Medium
- nexcess wpcompleteWordPress WPComplete plugin <= 2.9.5.5 - Broken Access Control vulnerabilityCVE-2026-576615.4 Medium
- stellarwp kadence blocks — page builder toolkit for gutenberg editorKadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData LocalizationCVE-2026-113574.3 Medium
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerabilityCVE-2026-49772Public exploit9.3 Critical
- liquid web / stellarwp event ticketsWordPress Event Tickets plugin <= 5.27.5 - Bypass Vulnerability vulnerabilityCVE-2026-426626.5 Medium
- liquid web / stellarwp givewpWordPress GiveWP plugin <= 4.14.2 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2026-349007.1 High
- liquid web / stellarwp givewpWordPress GiveWP plugin <= 4.14.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-426787.1 High
- nexcess wpcompleteWordPress WPComplete plugin <= 2.9.5.4 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-427506.5 Medium
- stellarwp image widgetWordPress Image Widget plugin <= 4.4.11 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-426435.9 Medium
- stellarwp givewpWordPress GiveWP plugin <= 4.14.5 - Broken Access Control vulnerabilityCVE-2026-426425.3 Medium
- stellarwp kadence blocks — page builder toolkit for gutenberg editorKadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media UploadCVE-2026-28264.3 Medium
- stellarwp restrict contentWordPress Restrict Content plugin <= 3.2.22 - Broken Access Control vulnerabilityCVE-2026-325467.5 High
- stellarwp learndash lmsLearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' ParameterCVE-2026-30796.5 Medium
- stellarwp membership plugin – restrict contentMembership Plugin – Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirectCVE-2026-41364.3 Medium
- stellarwp the events calendarThe Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_importCVE-2026-35857.5 High
- stellarwp membership plugin – restrict contentMembership Plugin – Restrict Content <= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp_level'CVE-2026-13218.1 High
- stellarwp the events calendarThe Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST APICVE-2026-26945.4 Medium
- solidwp ithemes syncWordPress iThemes Sync plugin <= 3.2.8 - Broken Access Control vulnerabilityCVE-2026-270564.3 Medium
- stellarwp kadence blocks — page builder toolkit for gutenberg editorGutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media UploadCVE-2026-26334.3 Medium
- Show moreLoading…