WP
Vendor
Wpexperts
58
CVEs
0
On KEV
6
New 30D
Products
AS5.3
APIExperts Square for WooCommerce
WPExperts
3 CVEs0 on KEV3 new
AF6.5
Advanced File Manager
WPExperts
1 CVEs0 on KEV1 new
CA5.3
CF7 Apps
WPExperts
1 CVEs0 on KEV1 new
WE5.3
WP EasyPay
WPExperts
1 CVEs0 on KEV1 new
PS9.8
Post SMTP
WPExperts
21 CVEs0 on KEV0 new
MY8.8
Mycred
Wpexperts
7 CVEs0 on KEV0 new
WM6.1
WP Multi Store Locator
Wpexperts
3 CVEs0 on KEV0 new
AI7.5
All IN One Login
Wpexperts
2 CVEs0 on KEV0 new
LM7.2
License Manager For Woocommerce
Wpexperts
2 CVEs0 on KEV0 new
NU8.8
New User Approve
Wpexperts
2 CVEs0 on KEV0 new
PP4.8
Password Protected
Wpexperts
2 CVEs0 on KEV0 new
WF5.3
Wholesale For Woocommerce
Wpexperts
2 CVEs0 on KEV0 new
WC4.8
WP Contact Slider
Wpexperts
2 CVEs0 on KEV0 new
ET8.8
Email Templates
Wpexperts
1 CVEs0 on KEV0 new
ET8.8
Email Templates Customizer And Designer
Wpexperts
1 CVEs0 on KEV0 new
GS6.5
Givewp Square
Wpexperts
1 CVEs0 on KEV0 new
GF8.5
Gravity Forms Bookings premium
WPExperts
1 CVEs0 on KEV0 new
RM4.8
Rocket Maintenance Mode & Coming Soon Page
Wpexperts
1 CVEs0 on KEV0 new
UA5.4
User Avatar-reloaded
Wpexperts
1 CVEs0 on KEV0 new
WS6.1
WC Shop Sync
Wpexperts
1 CVEs0 on KEV0 new
WP8.8
WP Pdf Generator
Wpexperts
1 CVEs0 on KEV0 new
WS4.8
WP Secure Maintenance
Wpexperts
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115959 New | AS APIExperts Square for WooCommerce WPExperts | 5.3 | Oct 26 | WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability |
| CVE-2026-115960 New | AS APIExperts Square for WooCommerce WPExperts | 4.3 | Oct 26 | WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability |
| CVE-2026-110365 | AF Advanced File Manager WPExperts | 6.5 | Oct 18 | WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability |
| CVE-2026-96449 | WE WP EasyPay WPExperts | 5.3 | Oct 15 | WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability |
| CVE-2026-110367 | AS APIExperts Square for WooCommerce WPExperts | 5.3 | Oct 15 | WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability |
| CVE-2026-62058 | CA CF7 Apps WPExperts | 5.3 | Oct 1 | WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability |
| CVE-2026-81278 | PS Post SMTP WPExperts | 5.4 | Aug 31 | WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability |
| CVE-2026-32466 | GF Gravity Forms Bookings premium WPExperts | 8.5 | Aug 18 | WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability |
| CVE-2026-48838 | PS Post SMTP WPExperts | 7.1 | Jun 15 | WordPress Post SMTP plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-13844 | PS Post Smtp Wpexperts | 4.9 | Mar 8 | The Post SMTP plugin for WordPress is vulnerable to generic SQL Injection via the ‘columns’ parameter in all versions up to, and including, 3.1.2 due to insufficient escaping on… |
| CVE-2024-13713 | GS Givewp Square Wpexperts | 6.5 | Feb 21 | The WPExperts Square For GiveWP plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.3.1 due to insufficient… |
| CVE-2025-0521 | PS Post Smtp Wpexperts | 6.1 | Feb 18 | The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, and including, 3.0.2 due to insufficient… |
| CVE-2025-24680 | WM WP Multi Store Locator Wpexperts | 6.1 | Jan 27 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Reflected XSS.This… |
| CVE-2025-22800 | PS Post Smtp Wpexperts | 8.8 | Jan 13 | Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from… |
| CVE-2024-12475 | WM WP Multi Store Locator Wpexperts | 5.4 | Jan 4 | WP Multi Store Locator <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2024-52436 | PS Post Smtp Wpexperts | 7.2 | Nov 18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal Post SMTP post-smtp allows Blind SQL Injection.This issue affects… |
| CVE-2024-43214 | MY Mycred Wpexperts | 5.3 | Aug 26 | Missing Authorization vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2 |
| CVE-2024-4753 | WS WP Secure Maintenance Wpexperts | 4.8 | Jul 12 | The WP Secure Maintenance WordPress plugin before 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored… |
| CVE-2024-1639 | LM License Manager For Woocommerce Wpexperts | 6.5 | Jun 21 | The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey() and… |
| CVE-2023-52233 | PS Post Smtp Wpexperts | 9.8 | Jun 11 | Missing Authorization vulnerability in Post SMTP Post SMTP Mailer/Email Log.This issue affects Post SMTP Mailer/Email Log: from n/a through 2.8.6 |
| CVE-2024-5207 | PS Post Smtp Wpexperts | 7.2 | May 30 | The POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for WordPress is vulnerable to time-based SQL Injection via the… |
| CVE-2024-31297 | WF Wholesale For Woocommerce Wpexperts | 5.3 | Apr 10 | Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0 |
| CVE-2024-30469 | WF Wholesale For Woocommerce Wpexperts | 5.3 | Mar 29 | Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0 |
| CVE-2024-29128 | PS Post Smtp Wpexperts | 6.1 | Mar 19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Post SMTP POST SMTP allows Reflected XSS.This issue affects POST SMTP: from… |
| CVE-2024-27959 | WS WC Shop Sync Wpexperts | 6.1 | Mar 17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpexpertsio WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop… |
| CVE-2024-0656 | PP Password Protected Wpexperts | 4.8 | Feb 29 | The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google… |
| CVE-2023-3178 | PS Post Smtp Wpexperts | 4.3 | Jan 16 | The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the… |
| CVE-2023-6620 | PS Post Smtp Wpexperts | 7.2 | Jan 15 | The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several parameters before using them in SQL statements, leading to a SQL injection… |
| CVE-2023-6875 | PS Post Smtp Wpexperts | 9.8 | Jan 11 | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and… |
| CVE-2023-6621 | PS Post Smtp Wpexperts | 6.1 | Jan 3 | The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which… |
| CVE-2023-7027 | PS Post Smtp Wpexperts | 5.4 | Jan 3 | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… |
| CVE-2023-6629 | PS Post Smtp Wpexperts | 6.1 | Jan 3 | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the… |
| CVE-2023-50902 | NU New User Approve Wpexperts | 8.8 | Dec 29 | Cross-Site Request Forgery (CSRF) vulnerability in WPExpertsio New User Approve.This issue affects New User Approve: from n/a through 2.5.1 |
| CVE-2023-49842 | RM Rocket Maintenance Mode & Coming Soon Page Wpexperts | 4.8 | Dec 14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpexpertsio Rocket Maintenance Mode & Coming Soon Page allows Stored XSS.This… |
| CVE-2023-47853 | MY Mycred Wpexperts | 5.4 | Nov 30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin… |
| CVE-2023-48742 | LM License Manager For Woocommerce Wpexperts | 7.2 | Nov 30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LicenseManager License Manager for WooCommerce… |
| CVE-2023-5958 | PS Post Smtp Wpexperts | 6.1 | Nov 27 | The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS… |
| CVE-2022-47181 | ET Email Templates Customizer And Designer Wpexperts | 8.8 | Nov 7 | Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-templates allows Cross Site Request… |
| CVE-2023-4798 | UA User Avatar-reloaded Wpexperts | 5.4 | Oct 16 | The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like… |
| CVE-2023-3604 | AI All IN One Login Wpexperts | 7.5 | Aug 21 | The Change WP Admin Login WordPress plugin before 1.1.4 discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered |
| CVE-2023-3179 | PS Post Smtp Wpexperts | 8.8 | Jul 17 | The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the… |
| CVE-2023-35096 | MY Mycred Wpexperts | 8.8 | Jul 17 | Cross-Site Request Forgery (CSRF) vulnerability in myCred plugin <= 2.5 versions |
| CVE-2023-35038 | WP WP Pdf Generator Wpexperts | 8.8 | Jul 17 | Cross-Site Request Forgery (CSRF) vulnerability in wpexperts.Io WP PDF Generator plugin <= 1.2.2 versions |
| CVE-2021-4422 | PS Post Smtp Wpexperts | 4.3 | Jul 12 | The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20 |
| CVE-2023-3082 | PS Post Smtp Wpexperts | 6.1 | Jul 12 | The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 due to insufficient input sanitization… |
| CVE-2023-32580 | PP Password Protected Wpexperts | 4.8 | Jun 23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPExperts Password Protected plugin <= 2.6.2 versions |
| CVE-2019-25150 | ET Email Templates Wpexperts | 8.8 | Jun 7 | The Email Templates plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.3 |
| CVE-2023-0152 | WM WP Multi Store Locator Wpexperts | 5.4 | Jun 5 | The WP Multi Store Locator WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
| CVE-2022-3237 | WC WP Contact Slider Wpexperts | 4.8 | Oct 31 | WP Contact Slider < 2.4.8 - Admin+ Stored Cross-Site Scripting |
| CVE-2022-2352 | PS Post Smtp Wpexperts | 7.2 | Sep 26 | The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to… |
| CVE-2022-2351 | PS Post Smtp Wpexperts | 4.8 | Sep 16 | The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to… |
| CVE-2022-1301 | WC WP Contact Slider Wpexperts | 4.8 | Jul 4 | The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders, which could allow high privileged users such as editor… |
| CVE-2022-1625 | NU New User Approve Wpexperts | 4.3 | Jun 27 | The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow attackers to add… |
| CVE-2022-1589 | AI All IN One Login Wpexperts | 7.5 | May 30 | The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow… |
| CVE-2022-1092 | MY Mycred Wpexperts | 4.3 | Apr 25 | The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and… |
| CVE-2022-0363 | MY Mycred Wpexperts | 4.3 | Apr 25 | The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as… |
| CVE-2022-0287 | MY Mycred Wpexperts | 4.3 | Apr 25 | The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated user, such as… |
| CVE-2021-24755 | MY Mycred Wpexperts | 8.8 | Nov 29 | The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any… |