Pickplugins
72 CVEs across 34 Pickplugins products. Browse Pickplugins vulnerabilities, severities, and proof-of-concept exploits.
Pickplugins products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-10207 | High | 7.5 | 2026-07-28 | The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitiz… |
CVE-2026-65456 | Medium | 4.3 | 2026-07-23 | Contributor Insecure Direct Object References (IDOR) in Product Slider for WooCommerce <= 1.13.62 versions. |
CVE-2026-10862 | Medium | 6.4 | 2026-06-09 | The Accordions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Accordion body field in all versions up to, and including, 2.3.23 due… |
CVE-2025-62745 | Medium | 6.5 | 2026-05-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Team Showcase allows Stored XSS. This issue… |
CVE-2026-7458 | Critical | 9.8 | 2026-05-02 | The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to t… |
CVE-2026-32497 | Medium | 5.3 | 2026-03-25 | Weak Authentication vulnerability in PickPlugins User Verification user-verification allows Authentication Abuse.This issue affects User Verification: from n/a… |
CVE-2026-25455 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-products-slider allows Exploiting Incorrectly Configured Access C… |
CVE-2025-68000 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-68605 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allo… |
CVE-2025-66058 | Medium | 6.5 | 2025-12-18 | Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-63043 | Medium | 5.3 | 2025-12-18 | Authorization Bypass Through User-Controlled Key vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured… |
CVE-2025-12374 | Critical | 9.8 | 2025-12-05 | The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to auth… |
CVE-2025-62929 | Medium | 6.5 | 2025-10-27 | Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-62924 | Medium | 6.5 | 2025-10-27 | Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-53421 | Medium | 6.5 | 2025-10-22 | Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-60162 | Medium | 6.5 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager job-board-manager allows DO… |
CVE-2025-58678 | Medium | 6.5 | 2025-09-22 | Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-58827 | Low | 3.8 | 2025-09-05 | Improper Control of Generation of Code ('Code Injection') vulnerability in PickPlugins Job Board Manager job-board-manager allows Code Injection.This issue aff… |
CVE-2025-54007 | High | 8.8 | 2025-08-20 | Deserialization of Untrusted Data vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Object Injection.This issue affects Post Grid an… |
CVE-2025-49324 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-49075 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Wishlist wishlist allows Stored XSS.This issu… |
CVE-2024-9645 | Medium | 5.4 | 2025-05-15 | The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of its block options be… |
CVE-2025-32647 | High | 8.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in PickPlugins Question Answer question-answer allows Object Injection.This issue affects Question Answer: from… |
CVE-2025-32646 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Question Answer question-answer allows Reflec… |
CVE-2025-24655 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Wishlist wishlist allows Reflected XSS.This i… |
CVE-2025-32618 | High | 8.5 | 2025-04-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist wishlist allows SQL Injection.This i… |
CVE-2025-32144 | High | 8.8 | 2025-04-11 | Deserialization of Untrusted Data vulnerability in PickPlugins Job Board Manager job-board-manager allows Object Injection.This issue affects Job Board Manager… |
CVE-2025-32143 | High | 8.8 | 2025-04-11 | Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through <= 2… |
CVE-2025-32272 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in PickPlugins Wishlist wishlist allows Cross Site Request Forgery.This issue affects Wishlist: from n/a throug… |
CVE-2025-30889 | High | 8.8 | 2025-04-03 | Deserialization of Untrusted Data vulnerability in PickPlugins Testimonial Slider testimonial allows Object Injection.This issue affects Testimonial Slider: fr… |
CVE-2025-31862 | Medium | 5.3 | 2025-04-01 | Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-31810 | Medium | 5.3 | 2025-04-01 | Missing Authorization vulnerability in PickPlugins Question Answer question-answer allows Accessing Functionality Not Properly Constrained by ACLs.This issue a… |
CVE-2024-12634 | Medium | 6.1 | 2025-03-07 | The Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins plugin for WordPress is vulnerable to Cross-Site Request Forg… |
CVE-2024-12809 | Medium | 6.4 | 2025-03-07 | The Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wishlist_button' shortcode in all versions up to, and includin… |
CVE-2024-13469 | Medium | 6.4 | 2025-02-28 | The Pricing Table by PickPlugins plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button Link in all versions up to, and including, 1… |
CVE-2024-13796 | Medium | 5.3 | 2025-02-28 | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3… |
CVE-2025-26915 | High | 8.5 | 2025-02-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist wishlist allows SQL Injection.This i… |
CVE-2024-13798 | Medium | 5.3 | 2025-02-22 | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 2.3.5… |
CVE-2025-22679 | High | 7.1 | 2025-02-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager job-board-manager allows Re… |
CVE-2025-24622 | Medium | 5.4 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in PickPlugins Job Board Manager job-board-manager allows Cross Site Request Forgery.This issue affects Job Boa… |
CVE-2024-13408 | High | 7.5 | 2025-01-24 | The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in al… |
CVE-2024-9636 | Critical | 9.8 | 2025-01-15 | The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in versions 2.2.85 to 2.3.3. This is due to the plugin not proper… |
CVE-2024-55993 | Medium | 5.3 | 2024-12-16 | Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2024-54273 | Critical | 9.8 | 2024-12-13 | Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker mail-picker allows Object Injection.This issue affects Mail Picker: from n/a through… |
CVE-2024-10937 | Medium | 5.3 | 2024-12-05 | The Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins plugin for WordPress is vulnerable to Sensitive Information E… |
CVE-2024-53772 | Medium | 6.5 | 2024-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Mail Picker mail-picker allows DOM-Based XSS… |
CVE-2024-9111 | Medium | 6.4 | 2024-11-21 | The Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.36 due to… |
CVE-2024-38726 | High | 7.5 | 2024-11-01 | Missing Authorization vulnerability in PickPlugins Product Designer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Product… |
CVE-2024-50432 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allo… |
CVE-2021-4450 | High | 8.8 | 2024-10-16 | The Post Grid plugin for WordPress is vulnerable to blind SQL Injection via post metadata in versions up to, and including, 2.1.12 due to insufficient escaping… |
CVE-2024-47342 | Medium | 6.5 | 2024-10-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Accordion accordions allows Stored XSS.This i… |
CVE-2024-47340 | Medium | 6.5 | 2024-10-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allo… |
CVE-2024-44002 | High | 7.1 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Team Showcase team allows Reflected XSS.This… |
CVE-2024-45459 | High | 7.1 | 2024-09-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-pr… |
CVE-2024-8253 | High | 8.8 | 2024-09-11 | The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to 2.2.90. This is due to the plugin not p… |
CVE-2024-43321 | Medium | 6.5 | 2024-08-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins Team Showcase allows Stored XSS.This i… |
CVE-2024-7588 | Medium | 6.4 | 2024-08-14 | The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Accordion block in all vers… |
CVE-2024-43155 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins ComboBlocks allows Stored XSS.This iss… |
CVE-2024-6346 | Medium | 6.4 | 2024-08-01 | The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the redirectURL parameter of the Date Co… |
CVE-2024-38722 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins Job Board Manager allows Stored XSS.Th… |
CVE-2024-3608 | Medium | 5.3 | 2024-07-09 | The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_atta… |
CVE-2024-4042 | Medium | 6.4 | 2024-06-07 | The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-1988 | Medium | 6.4 | 2024-06-07 | The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2023-40557 | Medium | 5.4 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PickPlugins Tabs & Accordion allows Code Injection.This issue af… |
CVE-2024-3155 | Medium | 6.4 | 2024-05-21 | The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-32816 | High | 7.5 | 2024-04-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid.This issue affects Post Grid: from n/a through 2.2.78. |
CVE-2024-0881 | Medium | 5.4 | 2024-04-11 | The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resu… |
CVE-2024-1641 | Medium | 5.4 | 2024-04-09 | The Accordion plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'accordions_d… |
CVE-2024-31277 | High | 8.7 | 2024-04-07 | Deserialization of Untrusted Data vulnerability in PickPlugins Product Designer.This issue affects Product Designer: from n/a through 1.0.32. |
CVE-2024-30441 | High | 7.1 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid allows Reflected XSS.This issue aff… |
CVE-2024-29097 | Medium | 6.3 | 2024-03-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins User profile allows Stored XSS.This issue aff… |
CVE-2023-7072 | High | 7.5 | 2024-03-12 | The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.68 vi… |
CVE-2023-51666 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Related Post allows Stored XSS.This issue aff… |
CVE-2023-6645 | Medium | 6.4 | 2024-01-11 | The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in all versions up to… |
CVE-2023-40211 | High | 7.5 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Com… |
CVE-2023-0166 | Medium | 5.4 | 2023-02-13 | The Product Slider for WooCommerce by PickPlugins WordPress plugin before 1.13.42 does not validate and escape some of its shortcode attributes before outputti… |
CVE-2022-4836 | Medium | 5.4 | 2023-02-06 | The Breadcrumb WordPress plugin before 1.5.33 does not validate and escape some of its shortcode attributes before outputting them back in the page, which coul… |
CVE-2022-4693 | Critical | 9.8 | 2023-01-23 | The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we only need to know the… |
CVE-2022-0447 | Medium | 6.4 | 2022-04-11 | The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_u… |
CVE-2021-24986 | Medium | 6.1 | 2022-04-11 | The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site… |
CVE-2021-24488 | Medium | 6.1 | 2021-08-02 | The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back… |
CVE-2021-24300 | Medium | 6.1 | 2021-05-24 | The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET p… |
CVE-2021-24283 | Medium | 5.4 | 2021-05-14 | The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue. |
CVE-2020-35939 | High | 7.5 | 2021-01-01 | PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP obje… |
CVE-2020-35938 | High | 7.5 | 2021-01-01 | PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects d… |
CVE-2020-35937 | High | 7.5 | 2021-01-01 | Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layou… |
CVE-2020-35936 | High | 7.5 | 2021-01-01 | Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts in… |
CVE-2020-13644 | Medium | 5.4 | 2020-05-28 | An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authent… |