Stellarwp
116 CVEs across 21 Stellarwp products. Browse Stellarwp vulnerabilities, severities, and proof-of-concept exploits.
Stellarwp products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9273 | Critical | 9.3 | 2026-08-05 | The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account… |
CVE-2026-18435 | Medium | 6.4 | 2026-08-01 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'toggleIcon' Block Attribu… |
CVE-2026-18062 | Medium | 6.4 | 2026-08-01 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image… |
CVE-2026-14987 | Medium | 6.4 | 2026-07-16 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'twitter_message' Sequoia Template… |
CVE-2026-15286 | Medium | 4.3 | 2026-07-10 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to unauthorized post publication in all versions up to, a… |
CVE-2026-13704 | Medium | 6.4 | 2026-07-02 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sequoia[introduction][image]'… |
CVE-2026-13246 | Medium | 6.4 | 2026-07-01 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_id' (and other) shortcod… |
CVE-2026-12904 | Medium | 4.3 | 2026-07-01 | The Kadence Blocks – Gutenberg Blocks for Page Builder Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and in… |
CVE-2026-12902 | Medium | 4.3 | 2026-07-01 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-11981 | Medium | 4.3 | 2026-07-01 | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing nonce validation on… |
CVE-2026-11357 | Medium | 4.3 | 2026-06-18 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and… |
CVE-2026-42643 | Medium | 5.9 | 2026-04-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP Image Widget image-widget allows Stored XSS.Thi… |
CVE-2026-42642 | Medium | 5.3 | 2026-04-29 | Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP… |
CVE-2026-2826 | Medium | 4.3 | 2026-04-04 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-32546 | High | 7.5 | 2026-03-25 | Missing Authorization vulnerability in StellarWP Restrict Content restrict-content allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-3079 | Medium | 6.5 | 2026-03-24 | The LearnDash LMS plugin for WordPress is vulnerable to blind time-based SQL Injection via the 'filters[orderby_order]' parameter in the 'learndash_propanel_te… |
CVE-2026-4136 | Medium | 4.3 | 2026-03-20 | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.2.24. This is due t… |
CVE-2026-3585 | High | 7.5 | 2026-03-10 | The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' functio… |
CVE-2026-1321 | High | 8.1 | 2026-03-05 | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.20. This is due t… |
CVE-2026-2694 | Medium | 5.4 | 2026-02-25 | The The Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to an improper capability check on the 'ca… |
CVE-2026-27056 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in StellarWP iThemes Sync ithemes-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-2633 | Medium | 4.3 | 2026-02-18 | The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.1. This is due… |
CVE-2026-1857 | Medium | 4.3 | 2026-02-18 | The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.6.1. This… |
CVE-2026-1304 | Medium | 4.4 | 2026-02-18 | The Membership Plugin – Restrict Content for WordPress is vulnerable to Stored Cross-Site Scripting via multiple invoice settings fields in all versions up to… |
CVE-2026-2608 | Medium | 4.3 | 2026-02-17 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a… |
CVE-2025-15043 | Medium | 5.4 | 2026-01-20 | The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'start_migration', 'cancel_migration… |
CVE-2025-14844 | High | 8.2 | 2026-01-16 | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 3.2.16 via the 'rcp… |
CVE-2025-69352 | Medium | 5.4 | 2026-01-06 | Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-14000 | Medium | 6.4 | 2025-12-23 | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'register_form' and 'restrict' shor… |
CVE-2025-67467 | Medium | 5.4 | 2025-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give allows Cross Site Request Forgery.This issue affects GiveWP: from n/a through <= 4.13… |
CVE-2025-66533 | Medium | 5.3 | 2025-12-09 | Improper Control of Generation of Code ('Code Injection') vulnerability in StellarWP GiveWP give allows Code Injection.This issue affects GiveWP: from n/a thro… |
CVE-2025-13387 | High | 7.2 | 2025-12-02 | The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer name in all versions up to, and inclu… |
CVE-2025-13206 | High | 7.2 | 2025-11-19 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all version… |
CVE-2025-12633 | High | 7.5 | 2025-11-12 | The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2025-12192 | Medium | 5.3 | 2025-11-05 | The Events Calendar plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 6.15.9. The sysinfo REST endpoint compares t… |
CVE-2025-12197 | High | 7.5 | 2025-11-05 | The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient esca… |
CVE-2025-12175 | Medium | 4.3 | 2025-10-31 | The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'tec_qr_code_modal' AJAX endpoint in… |
CVE-2025-62027 | Medium | 5.4 | 2025-10-22 | Missing Authorization vulnerability in StellarWP Event Tickets event-tickets.This issue affects Event Tickets: from n/a through <= 5.26.3. |
CVE-2025-49906 | Medium | 5.3 | 2025-10-22 | Missing Authorization vulnerability in StellarWP WPComplete wpcomplete allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPCom… |
CVE-2025-11517 | High | 7.5 | 2025-10-18 | The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-js… |
CVE-2025-11228 | Medium | 5.3 | 2025-10-04 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2025-11227 | Medium | 6.5 | 2025-10-04 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 v… |
CVE-2025-58974 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP WPComplete wpcomplete allows Stored XSS.This is… |
CVE-2025-9808 | Medium | 5.3 | 2025-09-16 | The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This mak… |
CVE-2025-9807 | High | 7.5 | 2025-09-12 | The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the ‘s’ parameter in all versions up to, and including, 6.15.1 due t… |
CVE-2025-7221 | Medium | 4.3 | 2025-08-21 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2025-54697 | High | 7.2 | 2025-08-14 | Incorrect Privilege Assignment vulnerability in StellarWP Kadence WooCommerce Email Designer kadence-woocommerce-email-designer allows Privilege Escalation.Thi… |
CVE-2025-8620 | Medium | 5.3 | 2025-08-06 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. T… |
CVE-2025-7205 | Medium | 5.4 | 2025-07-31 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes parameter in all ve… |
CVE-2025-5678 | Medium | 6.4 | 2025-07-09 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘redirectURL’ para… |
CVE-2025-50046 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP WPComplete wpcomplete allows Stored XSS.This is… |
CVE-2025-4571 | Medium | 5.4 | 2025-06-19 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient c… |
CVE-2025-5144 | Medium | 6.4 | 2025-06-11 | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-*’ parameters in all versions up to, and including… |
CVE-2025-48246 | Medium | 5.4 | 2025-05-19 | Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2024-8493 | Medium | 4.8 | 2025-05-15 | The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2025-39557 | Critical | 9.1 | 2025-04-16 | Unrestricted Upload of File with Dangerous Type vulnerability in StellarWP Kadence WooCommerce Email Designer kadence-woocommerce-email-designer allows Upload… |
CVE-2025-30794 | High | 7.1 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP Event Tickets event-tickets allows Reflected XS… |
CVE-2025-2331 | Medium | 5.3 | 2025-03-22 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2025-2025 | Medium | 6.5 | 2025-03-15 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th… |
CVE-2025-0912 | Critical | 9.8 | 2025-03-04 | The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted i… |
CVE-2025-1291 | Medium | 6.4 | 2025-03-01 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘icon’ parameter i… |
CVE-2025-22633 | Medium | 5.8 | 2025-02-23 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in StellarWP Give – Divi Donation Modules give-donation-modules-f… |
CVE-2025-1402 | Medium | 5.3 | 2025-02-21 | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajax_ticket_delete… |
CVE-2024-13457 | Medium | 5.3 | 2025-01-30 | The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.18.1 via the… |
CVE-2025-24537 | Medium | 5.4 | 2025-01-27 | Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site Request Forgery.This issue affects The E… |
CVE-2024-11090 | Medium | 5.3 | 2025-01-26 | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.13 via… |
CVE-2025-24753 | Medium | 4.3 | 2025-01-24 | Missing Authorization vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2024-12118 | Medium | 6.4 | 2025-01-23 | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar Link Widget through the html_tag attribute in… |
CVE-2025-22777 | Critical | 9.8 | 2025-01-13 | Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3. |
CVE-2024-12877 | Critical | 9.8 | 2025-01-11 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 v… |
CVE-2024-12304 | Medium | 6.4 | 2025-01-11 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via button block link in a… |
CVE-2024-38762 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in StellarWP Event Tickets event-tickets allows Cross Site Request Forgery.This issue affects Event Tickets: fr… |
CVE-2024-37518 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site Request Forgery.This issue affects The E… |
CVE-2023-47183 | Medium | 5.3 | 2025-01-02 | Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP… |
CVE-2024-5333 | Medium | 5.3 | 2024-12-16 | The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about pa… |
CVE-2024-12581 | Medium | 4.4 | 2024-12-13 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all… |
CVE-2024-10939 | Medium | 4.8 | 2024-12-13 | The Image Widget WordPress plugin before 4.4.11 does not sanitise and escape some of its Image Widget settings, which could allow high privilege users such as… |
CVE-2024-10785 | Medium | 6.4 | 2024-11-21 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Countdown' widget… |
CVE-2024-9655 | Medium | 6.4 | 2024-11-01 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon widg… |
CVE-2022-4974 | Medium | 6.3 | 2024-10-16 | The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to… |
CVE-2024-9634 | Critical | 9.8 | 2024-10-16 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 v… |
CVE-2024-8353 | Critical | 9.8 | 2024-09-28 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 v… |
CVE-2024-6931 | High | 7.2 | 2024-09-27 | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and including, 6.6.3 due t… |
CVE-2024-9130 | High | 7.2 | 2024-09-27 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions… |
CVE-2024-47315 | Medium | 5.4 | 2024-09-25 | Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.15.1. |
CVE-2024-8275 | Critical | 9.8 | 2024-09-25 | The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up… |
CVE-2024-6551 | Medium | 5.3 | 2024-08-29 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.15.1… |
CVE-2024-5941 | Medium | 5.4 | 2024-08-20 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capabilit… |
CVE-2024-5940 | Medium | 6.5 | 2024-08-20 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2024-5939 | Medium | 5.3 | 2024-08-20 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th… |
CVE-2024-5932 | Critical | 10.0 | 2024-08-20 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 v… |
CVE-2024-5977 | Medium | 5.4 | 2024-07-19 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includi… |
CVE-2024-5648 | Medium | 5.4 | 2024-07-09 | The LearnDash LMS – Reports plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions (i.e… |
CVE-2024-5819 | Medium | 6.4 | 2024-06-29 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data at… |
CVE-2024-5289 | Medium | 6.4 | 2024-06-27 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget… |
CVE-2024-4863 | Medium | 6.4 | 2024-06-14 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titleFont’ parame… |
CVE-2024-35679 | High | 7.1 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a… |
CVE-2024-4180 | Critical | 9.1 | 2024-06-04 | The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX. |
CVE-2024-3714 | Medium | 6.4 | 2024-05-18 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode… |
CVE-2024-4208 | Medium | 6.4 | 2024-05-15 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the typer effect in th… |