Shapedplugin
11 CVEs across 15 Shapedplugin products. Browse Shapedplugin vulnerabilities, severities, and proof-of-concept exploits.
Shapedplugin products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18988 | Medium | 6.4 | 2026-08-08 | The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and includi… |
CVE-2026-15652 | Medium | 6.4 | 2026-07-16 | The Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'align' Block Attribu… |
CVE-2026-7249 | Medium | 4.3 | 2026-05-22 | The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the `splw_update_block_options… |
CVE-2026-4665 | Medium | 6.4 | 2026-05-05 | The WP Carousel Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted fancybox `data-caption` attributes in all versions up to, an… |
CVE-2026-3017 | High | 7.2 | 2026-04-14 | The Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts plugin for WordPress is vulnerable to PHP Object Injection in all versions up… |
CVE-2025-12584 | Medium | 5.3 | 2025-11-27 | The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqv_popup_conte… |
CVE-2025-48134 | High | 7.2 | 2025-05-16 | Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC WP Tabs wp-expand-tabs-free allows Object Injection.This issue affects WP Tabs: from n/a th… |
CVE-2024-8187 | Medium | 4.8 | 2025-05-15 | The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-3996 | Low | 3.5 | 2025-05-15 | The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-11503 | Medium | 6.1 | 2025-03-25 | The WP Tabs WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform S… |
CVE-2024-5020 | Medium | 6.4 | 2024-12-04 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in… |
CVE-2024-32801 | Medium | 5.9 | 2024-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin Widget Post Slider allows Stored XSS.This is… |
CVE-2024-3020 | High | 7.2 | 2024-04-10 | The plugin is vulnerable to PHP Object Injection in versions up to and including, 2.6.3 via deserialization of untrusted input in the import function via the '… |
CVE-2024-2949 | Medium | 6.4 | 2024-04-06 | The Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce plugi… |
CVE-2024-1363 | Medium | 6.4 | 2024-03-13 | The Easy Accordion – Best Accordion FAQ Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordion_content_sourc… |
CVE-2023-52124 | Medium | 6.5 | 2024-01-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC WP Tabs – Responsive Tabs Plugin for Wor… |
CVE-2023-0537 | Medium | 5.4 | 2023-05-08 | The Product Slider For WooCommerce Lite WordPress plugin through 1.1.7 does not validate and escape some of its shortcode attributes before outputting them bac… |
CVE-2023-25065 | Medium | 5.4 | 2023-02-14 | Cross-Site Request Forgery (CSRF) vulnerability in ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress plugin <= 2.1.14 versions. |
CVE-2023-0360 | Medium | 5.4 | 2023-02-13 | The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a page/post where the… |
CVE-2023-0097 | Medium | 5.4 | 2023-01-30 | The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options before outputting the… |
CVE-2023-0071 | Medium | 5.4 | 2023-01-30 | The WP Tabs WordPress plugin before 2.1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the s… |
CVE-2022-4629 | Medium | 5.4 | 2023-01-23 | The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in t… |
CVE-2022-4648 | Medium | 5.4 | 2023-01-16 | The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, whic… |
CVE-2022-2382 | Medium | 4.3 | 2022-08-22 | The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authen… |
CVE-2021-24739 | High | 8.1 | 2021-12-21 | The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other user… |
CVE-2021-24738 | Medium | 5.4 | 2021-12-21 | The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as C… |