Wpopal
16 CVEs across 15 Wpopal products. Browse Wpopal vulnerabilities, severities, and proof-of-concept exploits.
Wpopal products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-62913 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpopal Opal Service opal-service allows Stored XSS.This i… |
CVE-2025-6934 | Critical | 9.8 | 2025-07-01 | The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to… |
CVE-2025-23967 | Critical | 9.3 | 2025-06-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpopal GG Bought Together for WooCommerce gg-bought-toget… |
CVE-2025-47535 | High | 8.6 | 2025-05-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-produc… |
CVE-2025-31748 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpopal Opal Portfolio opal-portfolios allows Stored XSS.T… |
CVE-2024-52444 | High | 7.5 | 2024-11-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-produc… |
CVE-2024-9073 | Medium | 6.4 | 2024-09-25 | The GutenGeek Free Gutenberg Blocks for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to… |
CVE-2024-7649 | Medium | 6.1 | 2024-08-12 | The Opal Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via checkout form fields in all versions up to, and including, 1.2.4 due… |
CVE-2024-7648 | Medium | 4.3 | 2024-08-12 | The Opal Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the private notes func… |
CVE-2024-3666 | Medium | 6.4 | 2024-05-22 | The Opal Estate Pro – Property Management and Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the agent latitude and longitude… |
CVE-2024-33649 | Medium | 6.5 | 2024-04-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpOpal Opal Widgets For Elementor allows Stored XSS.This… |
CVE-2022-40700 | High | 8.2 | 2024-01-19 | Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone… |
CVE-2023-6638 | Medium | 6.5 | 2024-01-11 | The GTG Product Feed for Shopping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_sett… |
CVE-2021-4388 | Medium | 4.3 | 2023-07-01 | The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due to missing capabil… |
CVE-2021-4387 | Medium | 4.3 | 2023-07-01 | The Opal Estate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.11. This is due to missing or incorrect… |
CVE-2022-29449 | Medium | 4.1 | 2022-05-19 | Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Opal Hotel Room Booking plugin <= 1.2.7 at WordPress. |