stellarwp

Top products

The 15 most recently published vulnerabilities affecting stellarwp.

• CVE-2026-9273Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover9.3Aug 5, 2026
• CVE-2026-18062Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content6.4Aug 1, 2026
• CVE-2026-18435Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute6.4Aug 1, 2026
• CVE-2026-14987GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting6.4Jul 16, 2026
• CVE-2026-15286Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication4.3Jul 10, 2026
• CVE-2026-13704GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form6.4Jul 2, 2026
• CVE-2026-11981GiveWP <= 4.15.3 - Cross-Site Request Forgery4.3Jul 1, 2026
• CVE-2026-12902Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions4.3Jul 1, 2026
• CVE-2026-12904Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter4.3Jul 1, 2026
• CVE-2026-13246GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute6.4Jul 1, 2026
• CVE-2026-11357Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization4.3Jun 18, 2026
• CVE-2026-42642WordPress GiveWP plugin <= 4.14.5 - Broken Access Control vulnerability5.3Apr 29, 2026
• CVE-2026-42643WordPress Image Widget plugin <= 4.4.11 - Cross Site Scripting (XSS) vulnerability5.9Apr 29, 2026
• CVE-2026-2826Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload4.3Apr 4, 2026
• CVE-2026-32546WordPress Restrict Content plugin <= 3.2.22 - Broken Access Control vulnerability7.5Mar 25, 2026