Login Request a demo
ST
Vendor
stellarwp
19 products with CVEs on record
141
CVEs
0
On KEV
3
New 30D
Products
GD
GiveWP – Donation Plugin and Fundraising Platform
stellarwp
9.8
33 CVEs0 on KEV1 new
KB
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
stellarwp
6.4
30 CVEs0 on KEV1 new
ET
Event Tickets and Registration
stellarwp
7.5
7 CVEs0 on KEV1 new
TE
The Events Calendar
stellarwp
9.8
25 CVEs0 on KEV0 new
GI
GiveWP
StellarWP
9.8
8 CVEs0 on KEV0 new
LL
LearnDash LMS
StellarWP
8.8
7 CVEs0 on KEV0 new
MP
Membership Plugin – Restrict Content
stellarwp
8.1
7 CVEs0 on KEV0 new
WP
WPComplete
stellarwp
6.5
4 CVEs0 on KEV0 new
ET
Event Tickets
StellarWP
7.1
3 CVEs0 on KEV0 new
GB
Gutenberg Blocks by Kadence Blocks
StellarWP
8.8
3 CVEs0 on KEV0 new
KW
Kadence WooCommerce Email Designer
stellarwp
9.1
3 CVEs0 on KEV0 new
BB
Bookit — Booking & Appointment Calendar
stellarwp
9.8
2 CVEs0 on KEV0 new
IW
Image Widget
StellarWP
5.9
2 CVEs0 on KEV0 new
RC
Restrict Content
StellarWP
7.5
2 CVEs0 on KEV0 new
GD
Give – Divi Donation Modules
StellarWP
5.8
1 CVEs0 on KEV0 new
IS
iThemes Sync
StellarWP
4.3
1 CVEs0 on KEV0 new
LL
LearnDash LMS – Reports
stellarwp
5.4
1 CVEs0 on KEV0 new
MP
Membership Plugin – Kadence Memberships
stellarwp
9.3
1 CVEs0 on KEV0 new
VI
Virtue
stellarwp
6.4
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-97643
GD
GiveWP – Donation Plugin and Fundraising Platform
stellarwp
6.4
0%
Oct 10GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes
CVE-2026-104762
KB
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
stellarwp
6.4
0%
Oct 10Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute
CVE-2026-97634
ET
Event Tickets and Registration
stellarwp
6.5
0%
Oct 2Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter
CVE-2026-77820
WP
WPComplete
stellarwp
6.4
0%
Sep 19WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute
CVE-2026-78159
TE
The Events Calendar
stellarwp
9.8
1%
Sep 12The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
CVE-2026-78006
TE
The Events Calendar
stellarwp
9.8
1%
Sep 12The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
CVE-2026-3174
ET
Event Tickets and Registration
stellarwp
7.5
0%
Sep 8Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update
CVE-2026-12843
LL
LearnDash LMS
StellarWP
5.4
0%
Sep 5LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint
CVE-2026-12483
LL
LearnDash LMS
StellarWP
7.5
1%
Sep 4LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler
CVE-2026-5510
GD
GiveWP – Donation Plugin and Fundraising Platform
stellarwp
6.4
0%
Aug 28GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
CVE-2026-9273
MP
Membership Plugin – Kadence Memberships
stellarwp
9.3
1%
Aug 5Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover
CVE-2026-18062
KB
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
stellarwp
6.4
0%
Aug 1Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content
CVE-2026-18435
KB
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
stellarwp
6.4
0%
Aug 1Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute
CVE-2026-14987
GD
GiveWP – Donation Plugin and Fundraising Platform
stellarwp
6.4
0%
Jul 16GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting
CVE-2026-15286
KB
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
stellarwp
4.3
0%
Jul 10Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication
CVE-2026-13704
GD
GiveWP – Donation Plugin and Fundraising Platform
stellarwp
6.4
0%
Jul 2GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form
CVE-2026-11981
GD
GiveWP – Donation Plugin and Fundraising Platform
stellarwp
4.3
0%
Jul 1GiveWP <= 4.15.3 - Cross-Site Request Forgery
CVE-2026-12902
KB
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
stellarwp
4.3
0%
Jul 1Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions
CVE-2026-12904
KB
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
stellarwp
4.3
0%
Jul 1Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter
CVE-2026-13246
GD
GiveWP – Donation Plugin and Fundraising Platform
stellarwp
6.4
0%
Jul 1GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute
CVE-2026-11357
KB
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
stellarwp
4.3
0%
Jun 18Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization
CVE-2026-42642
GI
GiveWP
StellarWP
5.3
0%
Apr 29WordPress GiveWP plugin <= 4.14.5 - Broken Access Control vulnerability
CVE-2026-42643
IW
Image Widget
StellarWP
5.9
0%
Apr 29WordPress Image Widget plugin <= 4.4.11 - Cross Site Scripting (XSS) vulnerability
CVE-2026-2826
KB
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
stellarwp
4.3
0%
Apr 4Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload
CVE-2026-32546
RC
Restrict Content
StellarWP
7.5
0%
Mar 25WordPress Restrict Content plugin <= 3.2.22 - Broken Access Control vulnerability
CVE-2026-3079
LL
LearnDash LMS
StellarWP
6.5
0%
Mar 24LearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter
CVE-2026-4136
MP
Membership Plugin – Restrict Content
stellarwp
4.3
0%
Mar 20Membership Plugin – Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirect
CVE-2026-3585
TE
The Events Calendar
stellarwp
7.5
0%
Mar 10The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import
CVE-2026-1321
MP
Membership Plugin – Restrict Content
stellarwp
8.1
0%
Mar 5Membership Plugin – Restrict Content <= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp_level'
CVE-2026-2694
TE
The Events Calendar
stellarwp
5.4
0%
Feb 25The Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API
CVE-2026-27056
IS
iThemes Sync
StellarWP
4.3
0%
Feb 19WordPress iThemes Sync plugin <= 3.2.8 - Broken Access Control vulnerability
CVE-2026-2633
KB
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
stellarwp
4.3
0%
Feb 18Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload
CVE-2026-1857
KB
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
stellarwp
4.3
0%
Feb 18Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter
CVE-2026-1304
MP
Membership Plugin – Restrict Content
stellarwp
4.4
0%
Feb 18Membership Plugin – Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings
CVE-2026-2608
KB
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
stellarwp
4.3
0%
Feb 17Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization
CVE-2025-15043
TE
The Events Calendar
stellarwp
5.4
0%
Jan 20The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control
CVE-2025-14844
MP
Membership Plugin – Restrict Content
stellarwp
7.5
0%
Jan 16Membership Plugin – Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure
CVE-2025-69352
TE
The Events Calendar
StellarWP
5.4
0%
Jan 6WordPress The Events Calendar plugin <= 6.15.12.2 - Broken Access Control vulnerability
CVE-2025-14000
MP
Membership Plugin – Restrict Content
stellarwp
6.4
0%
Dec 23Membership Plugin – Restrict Content <= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
CVE-2025-67467
GI
GiveWP
StellarWP
5.4
0%
Dec 9WordPress GiveWP plugin <= 4.13.1 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2025-13387
KW
Kadence WooCommerce Email Designer
stellarwp
7.2
0%
Dec 2Kadence WooCommerce Email Designer <= 1.5.17 - Unauthenticated Stored Cross-Site Scripting
CVE-2025-13206
GD
GiveWP – Donation Plugin and Fundraising Platform
stellarwp
6.1
0%
Nov 19GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name'
CVE-2025-12633
BB
Bookit — Booking & Appointment Calendar
stellarwp
7.5
0%
Nov 12Booking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe Connection
CVE-2025-12192
TE
The Events Calendar
stellarwp
5.3
0%
Nov 5The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure
CVE-2025-12197
TE
The Events Calendar
stellarwp
7.5
18%
Nov 5The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s
CVE-2025-12175
TE
The Events Calendar
stellarwp
4.3
0%
Oct 31The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure
CVE-2025-62027
ET
Event Tickets
StellarWP
5.4
0%
Oct 22WordPress Event Tickets plugin <= 5.26.3 - Broken Access Control vulnerability
CVE-2025-49906
WP
WPComplete
StellarWP
5.3
0%
Oct 22WordPress WPComplete plugin <= 2.9.5.3 - Broken Access Control vulnerability
CVE-2025-11517
ET
Event Tickets and Registration
stellarwp
7.5
0%
Oct 18Event Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment Bypass
CVE-2025-11228
GD
GiveWP – Donation Plugin and Fundraising Platform
stellarwp
5.3
0%
Oct 4GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association
CVE-2025-11227
GD
GiveWP – Donation Plugin and Fundraising Platform
stellarwp
6.5
0%
Oct 4GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure
CVE-2025-58974
WP
WPComplete
StellarWP
6.5
0%
Sep 22WordPress WPComplete Plugin <= 2.9.5.2 - Cross Site Scripting (XSS) Vulnerability
CVE-2025-9808
TE
The Events Calendar
stellarwp
5.3
1%
Sep 16The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure
CVE-2025-9807
TE
The Events Calendar
stellarwp
7.5
0%
Sep 12The Events Calendar <= 6.15.1 - Unauthenticated SQL Injection
CVE-2025-7221
GD
GiveWP – Donation Plugin and Fundraising Platform
stellarwp
4.3
0%
Aug 21GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update
CVE-2025-54697
KW
Kadence WooCommerce Email Designer
StellarWP
7.2
0%
Aug 14WordPress Kadence WooCommerce Email Designer Plugin <= 1.5.16 - Privilege Escalation Vulnerability
CVE-2025-8620
GD
GiveWP – Donation Plugin and Fundraising Platform
stellarwp
5.3
1%
Aug 6GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure
CVE-2025-7205
GD
GiveWP – Donation Plugin and Fundraising Platform
stellarwp
5.4
0%
Jul 31GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting
CVE-2025-5678
KB
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
stellarwp
5.4
0%
Jul 9Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter
CVE-2025-50046
WP
WPComplete
StellarWP
6.5
0%
Jun 20WordPress WPComplete plugin <= 2.9.5 - Cross Site Scripting (XSS) Vulnerability