Wpmet
28 CVEs across 19 Wpmet products. Browse Wpmet vulnerabilities, severities, and proof-of-concept exploits.
Wpmet products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-24611 | Critical | 9.1 | 2026-06-17 | Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions. |
CVE-2026-24610 | Medium | 4.3 | 2026-06-17 | Subscriber Broken Access Control in MetForm Pro <= 3.9.1 versions. |
CVE-2026-54197 | Medium | 6.5 | 2026-06-16 | Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions. |
CVE-2026-49053 | Medium | 5.3 | 2026-05-27 | Missing Authorization vulnerability in Wpmet ElementsKit Elementor addons Lite allows Exploiting Incorrectly Configured Access Control Security Levels. This i… |
CVE-2026-49052 | Medium | 4.3 | 2026-05-27 | Missing Authorization vulnerability in Wpmet ElementsKit Elementor addons Lite allows Exploiting Incorrectly Configured Access Control Security Levels. This i… |
CVE-2026-1782 | Medium | 5.3 | 2026-04-15 | The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 3.9.7 This is due to the payment integra… |
CVE-2026-1261 | High | 7.2 | 2026-03-10 | The MetForm Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Quiz feature in all versions up to, and including, 3.9.6 due to insuf… |
CVE-2025-3614 | Medium | 6.4 | 2025-07-24 | The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of a custom widget in al… |
CVE-2025-4479 | Medium | 6.4 | 2025-06-19 | The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image comparison widget's befor… |
CVE-2025-46253 | Medium | 6.5 | 2025-04-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ataur R GutenKit gutenkit-blocks-addon allows Stored XSS… |
CVE-2024-11180 | Medium | 6.4 | 2025-03-29 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Timer Widget ekit_countdown_timer_title pa… |
CVE-2025-1506 | Medium | 4.3 | 2025-02-28 | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.0. T… |
CVE-2025-0968 | Medium | 5.3 | 2025-02-19 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.0 due to a mis… |
CVE-2025-1005 | Medium | 6.4 | 2025-02-15 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion widget in all versions up t… |
CVE-2025-0321 | Medium | 6.4 | 2025-01-28 | The ElementsKit Pro plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3… |
CVE-2023-50903 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in Roxnor Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metfor… |
CVE-2024-37255 | Medium | 5.3 | 2024-11-01 | Missing Authorization vulnerability in Roxnor ElementsKit Elementor addons Lite elementskit-lite.This issue affects ElementsKit Elementor addons Lite: from n/a… |
CVE-2024-10091 | Medium | 6.4 | 2024-10-26 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Comparison Widget in all versions up to, and i… |
CVE-2024-8546 | Medium | 6.4 | 2024-09-25 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video widget in all versions up to, and inc… |
CVE-2024-43996 | Medium | 6.5 | 2024-09-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ElementsKit ElementsKit Pro allows PHP Local File Inclusion.Thi… |
CVE-2023-0714 | High | 8.1 | 2024-08-17 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and… |
CVE-2024-7064 | Medium | 6.4 | 2024-08-15 | The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 3.6.5 due to… |
CVE-2024-7063 | Medium | 4.3 | 2024-08-15 | The ElementsKit Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.6 via the 'render_raw' funct… |
CVE-2024-6698 | High | 8.8 | 2024-08-01 | The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plugin not properly v… |
CVE-2024-6455 | Medium | 5.3 | 2024-07-18 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due to a missing capabi… |
CVE-2023-39993 | Medium | 4.3 | 2024-06-19 | Missing Authorization vulnerability in Wpmet Elements kit Elementor addons.This issue affects Elements kit Elementor addons: from n/a through 2.9.0. |
CVE-2024-5263 | Medium | 6.4 | 2024-06-15 | The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Motion Text and Table widgets in all versions up to, and… |
CVE-2024-4404 | High | 8.5 | 2024-06-14 | The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.6.2 via the 'render_raw' function. Th… |
CVE-2024-34758 | Medium | 5.3 | 2024-06-11 | Missing Authorization vulnerability in Wpmet WP Fundraising Donation and Crowdfunding Platform.This issue affects WP Fundraising Donation and Crowdfunding Plat… |
CVE-2024-4266 | Medium | 5.3 | 2024-06-11 | The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions… |
CVE-2024-4452 | Medium | 6.4 | 2024-05-21 | The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and including, 3.6.1 due to in… |
CVE-2024-32685 | Medium | 5.3 | 2024-05-17 | Client-Side Enforcement of Server-Side Security vulnerability in Wpmet Wp Ultimate Review allows Functionality Bypass.This issue affects Wp Ultimate Review: fr… |
CVE-2024-21746 | Medium | 5.3 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Identity Spoofing.This issue affects Wp Ultimate Review… |
CVE-2024-33570 | Medium | 4.3 | 2024-05-06 | Missing Authorization vulnerability in Roxnor Metform metform.This issue affects Metform: from n/a through <= 3.8.3. |
CVE-2024-3650 | Medium | 6.4 | 2024-05-02 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all versions 3.0.7 through… |
CVE-2024-3500 | High | 8.8 | 2024-05-02 | The ElementsKit Pro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.0 via the Price Menu, Hotspot, and Adv… |
CVE-2024-3499 | High | 8.8 | 2024-05-02 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the generate_naviga… |
CVE-2024-32684 | Medium | 5.3 | 2024-04-22 | Missing Authorization vulnerability in Wpmet Wp Ultimate Review.This issue affects Wp Ultimate Review: from n/a through 2.2.5. |
CVE-2024-32683 | Medium | 5.3 | 2024-04-19 | Authorization Bypass Through User-Controlled Key vulnerability in Wpmet Wp Ultimate Review.This issue affects Wp Ultimate Review: from n/a through 2.2.5. |
CVE-2024-3598 | Medium | 6.4 | 2024-04-19 | The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Creative Button widget in all versions up to, and includ… |
CVE-2024-32505 | Medium | 6.5 | 2024-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roxnor ElementsKit Elementor addons Lite elementskit-lite… |
CVE-2024-2803 | Medium | 6.4 | 2024-04-04 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget in all versions up to, and includin… |
CVE-2024-2791 | Medium | 6.4 | 2024-04-02 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, an… |
CVE-2024-2047 | High | 8.8 | 2024-03-30 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.6 via the render_raw func… |
CVE-2024-1238 | Medium | 6.4 | 2024-03-30 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button ID parameter in all versions up to, and inclu… |
CVE-2024-2042 | Medium | 6.4 | 2024-03-16 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all versions up to, and in… |
CVE-2024-1239 | Medium | 6.4 | 2024-03-16 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blog post read more button in all versions up to, an… |
CVE-2023-6525 | Medium | 5.5 | 2024-03-16 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the progress bar element attributes in all versions up t… |
CVE-2024-1763 | Medium | 6.5 | 2024-03-13 | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th… |
CVE-2024-1585 | Medium | 6.4 | 2024-03-13 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up t… |
CVE-2022-47160 | Medium | 6.5 | 2024-01-19 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wpmet Wp Social Login and Register Social Counter.This issue affects Wp Social Logi… |
CVE-2023-6582 | Medium | 5.3 | 2024-01-11 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.3 via the ekit_… |
CVE-2023-6788 | Medium | 5.4 | 2024-01-09 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.1. This i… |
CVE-2023-28987 | Medium | 4.3 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.0.3 versions. |
CVE-2023-46085 | Medium | 4.3 | 2023-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.2.4 versions. |
CVE-2023-0689 | Medium | 4.3 | 2023-08-31 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_first_name' shortcode in versions up to, and inclu… |
CVE-2023-2517 | Medium | 5.4 | 2023-07-12 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.2. This is du… |
CVE-2023-28751 | Medium | 5.9 | 2023-06-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.0.3 versions. |
CVE-2023-1843 | Medium | 6.5 | 2023-06-09 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on t… |
CVE-2023-0721 | High | 8.3 | 2023-06-09 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthentic… |
CVE-2023-0710 | Medium | 4.9 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mf_thankyou' shortcode to… |
CVE-2023-0709 | Medium | 5.4 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form sub… |
CVE-2023-0708 | Medium | 5.4 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_first_name' shortcode to echo unescaped form su… |
CVE-2023-0695 | Medium | 5.4 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissions i… |
CVE-2023-0694 | Medium | 6.5 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1… |
CVE-2023-0693 | Medium | 6.5 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in versions up to, and i… |
CVE-2023-0692 | Medium | 4.3 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and i… |
CVE-2023-0691 | Medium | 4.3 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and includ… |
CVE-2023-0688 | Medium | 6.5 | 2023-06-09 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and includi… |
CVE-2022-45371 | Medium | 5.4 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in Wpmet ShopEngine plugin <= 4.1.1 versions. |
CVE-2023-0084 | High | 7.2 | 2023-03-02 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and inc… |
CVE-2023-0085 | Medium | 5.3 | 2023-03-02 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insuf… |
CVE-2022-0788 | Critical | 9.8 | 2022-06-08 | The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement… |
CVE-2022-1442 | High | 7.5 | 2022-05-10 | The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be… |
CVE-2021-24258 | Medium | 5.4 | 2021-05-05 | The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by… |