Wpwax
37 CVEs across 21 Wpwax products. Browse Wpwax vulnerabilities, severities, and proof-of-concept exploits.
Wpwax products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15028 | High | 7.2 | 2026-08-06 | The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2026-3141 | Critical | 9.1 | 2026-08-01 | The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/at… |
CVE-2026-59518 | Critical | 9.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through <= 8… |
CVE-2026-49073 | High | 8.5 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection. Th… |
CVE-2026-39509 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-22460 | High | 8.6 | 2026-03-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpWax FormGent formgent allows Path Traversal.This issue affect… |
CVE-2025-68069 | High | 7.1 | 2026-02-20 | Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-64250 | Medium | 4.7 | 2025-12-16 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wpWax Directorist directorist allows Phishing.This issue affects Directorist: from n/a thr… |
CVE-2025-66077 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-12174 | Medium | 6.5 | 2025-11-19 | The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access due to a missing c… |
CVE-2025-10488 | High | 8.1 | 2025-10-25 | The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to arbitrary file move due to insufficien… |
CVE-2025-48242 | Medium | 6.5 | 2025-05-19 | Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-32658 | Critical | 9.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in wpWax HelpGent helpgent allows Object Injection.This issue affects HelpGent: from n/a through <= 2.2.5. |
CVE-2025-39525 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Logo Carousel Slider logo-carousel-slider allows St… |
CVE-2025-32499 | Medium | 6.5 | 2025-04-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Logo Showcase Ultimate logo-show… |
CVE-2025-31857 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist AddonsKit for Elementor addonskit-for-e… |
CVE-2025-2224 | Medium | 5.3 | 2025-03-25 | The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access and modification… |
CVE-2025-1570 | High | 8.1 | 2025-02-28 | The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeo… |
CVE-2024-12041 | Medium | 5.3 | 2025-02-01 | The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to Information Exposure in all… |
CVE-2025-24782 | Medium | 6.5 | 2025-01-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Post Grid, Slider & Carousel Ult… |
CVE-2025-24681 | Medium | 5.9 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Product Carousel Slider & Grid Ultimate for WooComm… |
CVE-2024-13409 | High | 7.5 | 2025-01-24 | The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in al… |
CVE-2024-13408 | High | 7.5 | 2025-01-24 | The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in al… |
CVE-2024-12040 | High | 8.8 | 2024-12-12 | The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1… |
CVE-2024-44048 | Medium | 6.5 | 2024-09-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Product Carousel Slider & Grid U… |
CVE-2024-8046 | Medium | 6.4 | 2024-08-27 | The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in a… |
CVE-2024-33929 | Medium | 5.3 | 2024-05-03 | Missing Authorization vulnerability in wpWax Directorist.This issue affects Directorist: from n/a through 7.8.6. |
CVE-2024-32451 | Medium | 4.3 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages.This issue affects Legal Pages: from n/a through 1.4.2. |
CVE-2024-29925 | Medium | 6.5 | 2024-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Post Grid, Slider & Carousel Ultimate allows Stored… |
CVE-2023-50886 | Medium | 4.3 | 2024-03-15 | Cross-Site Request Forgery (CSRF), Incorrect Authorization vulnerability in wpWax Legal Pages.This issue affects Legal Pages: from n/a through 1.3.7. |
CVE-2024-2006 | High | 8.8 | 2024-03-13 | The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to PHP Object Injection in al… |
CVE-2024-1951 | High | 7.5 | 2024-03-13 | The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inclu… |
CVE-2024-1950 | High | 7.5 | 2024-03-13 | The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1… |
CVE-2024-1322 | Medium | 5.3 | 2024-02-29 | The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due… |
CVE-2023-2252 | Low | 2.7 | 2024-01-16 | The Directorist WordPress plugin before 7.5.4 is vulnerable to Local File Inclusion as it does not validate the file parameter when importing CSV files. |
CVE-2023-47824 | Medium | 5.4 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator plugin <= 1… |
CVE-2023-41798 | Medium | 5.1 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing… |
CVE-2023-1889 | Medium | 6.5 | 2023-06-09 | The Directorist plugin for WordPress is vulnerable to an Insecure Direct Object Reference in versions up to, and including, 7.5.4. This is due to improper vali… |
CVE-2023-1888 | High | 8.8 | 2023-06-09 | The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4. This is due to a lack of valida… |
CVE-2022-3961 | Medium | 6.5 | 2022-12-19 | The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system information. |
CVE-2022-3930 | Medium | 6.5 | 2022-12-12 | The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users ins… |
CVE-2022-2376 | Medium | 5.3 | 2022-09-05 | The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticate… |
CVE-2022-2377 | Medium | 4.3 | 2022-08-22 | The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary… |
CVE-2022-2046 | Medium | 4.9 | 2022-08-08 | The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the… |
CVE-2022-34853 | Medium | 4.1 | 2022-07-22 | Multiple Authenticated (contributor or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress. |
CVE-2022-34650 | Medium | 4.1 | 2022-07-22 | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress. |
CVE-2022-1266 | Medium | 4.8 | 2022-06-20 | The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users t… |
CVE-2021-24981 | High | 7.5 | 2021-12-21 | The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in th… |