SH
Vendor
Shapedplugin
28
CVEs
0
On KEV
0
New 30D
Products
WT8.8
WP Tabs
Shapedplugin
5 CVEs0 on KEV0 new
PS7.2
Product Slider For Woocommerce
Shapedplugin
4 CVEs0 on KEV0 new
CS7.2
Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel
shapedplugin
3 CVEs0 on KEV0 new
LC8.1
Logo Carousel
Shapedplugin
3 CVEs0 on KEV0 new
SP5.4
Smart Post Show
Shapedplugin
3 CVEs0 on KEV0 new
EA6.4
Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ
shapedplugin
2 CVEs0 on KEV0 new
LW5.4
Location Weather
Shapedplugin
1 CVEs0 on KEV0 new
LW4.3
Location Weather – WordPress Weather Forecast, AQI, Temperature and Weather Widget
shapedplugin
1 CVEs0 on KEV0 new
PG7.2
Post Grid, Post Carousel, & List Category Posts
Shapedplugin
1 CVEs0 on KEV0 new
QV5.3
Quick View for WooCommerce
shapedplugin
1 CVEs0 on KEV0 new
RT5.4
Real Testimonials
Shapedplugin
1 CVEs0 on KEV0 new
SP7.2
Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts
shapedplugin
1 CVEs0 on KEV0 new
WP5.9
Widget Post Slider
ShapedPlugin
1 CVEs0 on KEV0 new
WC5.4
WP Carousel
Shapedplugin
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-18988 | EA Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ shapedplugin | 6.4 | Aug 8 | Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute |
| CVE-2026-15652 | EA Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ shapedplugin | 6.4 | Jul 16 | Easy Accordion <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block Attribute |
| CVE-2026-7249 | LW Location Weather – WordPress Weather Forecast, AQI, Temperature and Weather Widget shapedplugin | 4.3 | May 22 | Location Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging |
| CVE-2026-4665 | CS Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel shapedplugin | 6.4 | May 5 | WP Carousel Free <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute |
| CVE-2026-3017 | SP Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts shapedplugin | 7.2 | Apr 14 | Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object Injection |
| CVE-2025-12584 | QV Quick View for WooCommerce shapedplugin | 5.3 | Nov 27 | Quick View for WooCommerce <= 2.2.17 - Unauthenticated Private Product Disclosure |
| CVE-2025-48134 | WT WP Tabs Shapedplugin | 7.2 | May 16 | WordPress WP Tabs plugin <= 2.2.12 - PHP Object Injection Vulnerability |
| CVE-2024-3996 | SP Smart Post Show Shapedplugin | 3.5 | May 15 | Post Grid, Post Carousel, & List Category Posts < 2.4.28 - Editor+ Stored XSS |
| CVE-2024-8187 | SP Smart Post Show Shapedplugin | 4.8 | May 15 | Smart Post Show <= 3.0.0 - Editor+ Stored XSS |
| CVE-2024-11503 | WT WP Tabs Shapedplugin | 6.1 | Mar 25 | WP Tabs < 2.2.7 - Admin+ Stored XSS |
| CVE-2024-5020 | CS Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel shapedplugin | 6.4 | Dec 4 | Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library |
| CVE-2024-32801 | WP Widget Post Slider ShapedPlugin | 5.9 | Apr 24 | WordPress Widget Post Slider plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-3020 | CS Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel shapedplugin | 7.2 | Apr 10 | Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Admin+) PHP Object Injection |
| CVE-2024-2949 | WC WP Carousel Shapedplugin | 5.4 | Apr 6 | The Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce plugin for WordPress is… |
| CVE-2023-52124 | WT WP Tabs Shapedplugin | 5.4 | Jan 5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC WP Tabs – Responsive Tabs Plugin for WordPress allows Stored… |
| CVE-2023-0537 | PS Product Slider For Woocommerce Shapedplugin | 5.4 | May 8 | The Product Slider For WooCommerce Lite WordPress plugin through 1.1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post… |
| CVE-2023-25065 | WT WP Tabs Shapedplugin | 8.8 | Feb 14 | Cross-Site Request Forgery (CSRF) vulnerability in ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress plugin <= 2.1.14 versions |
| CVE-2023-0360 | LW Location Weather Shapedplugin | 5.4 | Feb 13 | The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed,… |
| CVE-2023-0097 | SP Smart Post Show Shapedplugin | 5.4 | Jan 30 | The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options before outputting them back in a… |
| CVE-2023-0071 | WT WP Tabs Shapedplugin | 5.4 | Jan 30 | The WP Tabs WordPress plugin before 2.1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed,… |
| CVE-2022-4629 | PS Product Slider For Woocommerce Shapedplugin | 5.4 | Jan 23 | The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could… |
| CVE-2022-4648 | RT Real Testimonials Shapedplugin | 5.4 | Jan 16 | The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users… |
| CVE-2022-2382 | PS Product Slider For Woocommerce Shapedplugin | 4.3 | Aug 22 | The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such… |
| CVE-2021-24739 | LC Logo Carousel Shapedplugin | 8.1 | Dec 21 | The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel… |
| CVE-2021-24738 | LC Logo Carousel Shapedplugin | 5.4 | Dec 21 | The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as Contributor to… |