Xpeedstudio vulnerabilities

Products

• Metform 10
• Fundengine – Donation And Crowdfunding Platform 3
• Elementskit Elementor Addons 2
• Wp Fundraising Donation And Crowdfunding Platform 2

Newest

• wpmet metform WordPress Metform plugin <= 4.3.3 - Broken Access Control vulnerability CVE-2026-120847 4.3 MediumNovember 7, 2026
• wpmet metform WordPress Metform plugin <= 4.3.2 - Broken Access Control vulnerability CVE-2026-114180 5.3 MediumOctober 22, 2026
• unknown metform MetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field Shortcodes CVE-2026-86833 5.4 MediumOctober 7, 2026
• unknown metform MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration CVE-2026-86834 3.7 LowOctober 3, 2026
• unknown metform MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API CVE-2026-86832 5.3 MediumOctober 3, 2026
• wpmet metform WordPress Metform plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-103339 6.5 MediumOctober 1, 2026
• unknown metform MetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-To CVE-2026-86813 4.8 MediumSeptember 11, 2026
• roxnor fundengine – donation and crowdfunding platform FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter CVE-2026-76063 6.4 MediumAugust 25, 2026
• roxnor fundengine – donation and crowdfunding platform FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter CVE-2026-75930 4.3 MediumAugust 25, 2026
• unknown elementskit elementor addons ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite) CVE-2026-13393 3.5 LowJuly 31, 2026
• unknown elementskit elementor addons ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite) CVE-2026-13392 7.2 HighJuly 31, 2026
• xpeedstudio bajaar - highly customizable woocommerce wordpress theme WordPress Bajaar - Highly Customizable WooCommerce WordPress Theme theme <= 2.1.0 - Local File Inclusion vulnerability CVE-2025-69004 8.1 HighJanuary 22, 2026
• roxnor metform WordPress Metform Elementor Contact Form Builder plugin <= 3.9.7 - Server Side Request Forgery (SSRF) vulnerability CVE-2025-30914 4.4 MediumMarch 27, 2025
• roxnor metform, wpmet metform elementor contact form builder +1 more WordPress Metform Elementor Contact Form Builder plugin <= 3.4.0 - Broken Access Control vulnerability CVE-2023-50903 5.3 MediumDecember 9, 2024
• roxnor fundengine – donation and crowdfunding platform, wpmet fundengine, wp fundraising donation and crowdfunding platform +2 more FundEngine – Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation CVE-2024-6698 8.8 HighAugust 1, 2024
• wpmet wp fundraising donation and crowdfunding platform WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.6.4 - Broken Access Control vulnerability CVE-2024-34758 5.3 MediumJune 11, 2024
• roxnor metform, wpmet metform elementor contact form builder +1 more WordPress MetForm plugin <= 3.8.3 - Broken Access Control vulnerability CVE-2024-33570 4.3 MediumMay 6, 2024
• wpmet elements kit elementor addons, xpeedstudio elementskit elementor addons and templates library +1 more The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site... CVE-2024-3650 6.4 MediumMay 2, 2024
• unknown wp fundraising donation and crowdfunding platform, wpmet fundengine +1 more WP Fundraising Donation and Crowdfunding Platform < 1.5.0 - Unauthenticated SQLi CVE-2022-0788 9.8 CriticalJune 6, 2022