Login Request a demo
WP
Vendor
wpWax
14 products with CVEs on record
44
CVEs
0
On KEV
3
New 30D
Products
DA
Directorist: AI-Powered Business Directory, Listings & Classified Ads
wpwax
8.1
5 CVEs0 on KEV2 new
FO
FormGent
wpWax
8.6
2 CVEs0 on KEV1 new
DI
Directorist
wpWax
9.8
17 CVEs0 on KEV0 new
PG
Post Grid, Slider & Carousel Ultimate
Wpwax
8.8
5 CVEs0 on KEV0 new
LP
Legal Pages
wpWax
8.8
4 CVEs0 on KEV0 new
FN
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More
wpwax
9.1
2 CVEs0 on KEV0 new
TE
Team
Wpwax
5.4
2 CVEs0 on KEV0 new
DA
Directorist AddonsKit for Elementor
wpWax
6.5
1 CVEs0 on KEV0 new
DB
Directorist Booking
wpWax
8.5
1 CVEs0 on KEV0 new
HE
HelpGent
wpWax
9.8
1 CVEs0 on KEV0 new
LC
Logo Carousel Slider
wpWax
6.5
1 CVEs0 on KEV0 new
LS
Logo Showcase Ultimate
wpWax
6.5
1 CVEs0 on KEV0 new
PC
Product Carousel Slider & Grid Ultimate For Woocommerce
Wpwax
8.8
1 CVEs0 on KEV0 new
TE
Templatiq
wpWax
9.9
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-100185
DA
Directorist: AI-Powered Business Directory, Listings & Classified Ads
wpwax
6.4
0%
Oct 14Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field
CVE-2026-17092
DA
Directorist: AI-Powered Business Directory, Listings & Classified Ads
wpwax
8.1
1%
Oct 14Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter
CVE-2026-94499
FO
FormGent
wpWax
7.1
0%
Sep 30WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability
CVE-2026-32474
TE
Templatiq
wpWax
9.9
0%
Aug 18WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability
CVE-2025-15028
FN
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More
wpwax
7.2
0%
Aug 6FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting
CVE-2026-3141
FN
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More
wpwax
9.1
1%
Aug 1FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter
CVE-2026-59518
DI
Directorist
wpWax
9.8
1%
Jul 13WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability
CVE-2026-49073
DB
Directorist Booking
wpWax
8.5
0%
Jun 16WordPress Directorist Booking plugin <= 3.0.3 - SQL Injection vulnerability
CVE-2026-39509
DI
Directorist
wpWax
5.3
0%
Apr 8WordPress Directorist plugin <= 8.5.10 - Broken Access Control vulnerability
CVE-2026-22460
FO
FormGent
wpWax
8.6
0%
Mar 5WordPress FormGent plugin <= 1.7.0 - Arbitrary File Deletion vulnerability
CVE-2025-68069
DI
Directorist
wpWax
7.1
0%
Feb 20WordPress Directorist plugin <= 8.6.6 - Broken Access Control vulnerability
CVE-2025-64250
DI
Directorist
wpWax
4.7
0%
Dec 16WordPress Directorist plugin <= 8.6.6 - Open Redirection vulnerability
CVE-2025-66077
LP
Legal Pages
wpWax
5.3
0%
Nov 21WordPress Legal Pages plugin <= 1.4.6 - Broken Access Control vulnerability
CVE-2025-12174
DA
Directorist: AI-Powered Business Directory, Listings & Classified Ads
wpwax
6.5
0%
Nov 19Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update
CVE-2025-10488
DA
Directorist: AI-Powered Business Directory, Listings & Classified Ads
wpwax
8.1
1%
Oct 25Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move
CVE-2025-48242
LP
Legal Pages
wpWax
6.5
0%
May 19WordPress Legal Pages plugin <= 1.4.5 - Broken Access Control Vulnerability
CVE-2025-32658
HE
HelpGent
wpWax
9.8
1%
Apr 17WordPress HelpGent plugin <= 2.2.5 - PHP Object Injection vulnerability
CVE-2025-39525
LC
Logo Carousel Slider
wpWax
6.5
0%
Apr 16WordPress Logo Carousel Slider plugin <= 2.1.3 - Cross Site Scripting (XSS) Vulnerability
CVE-2025-32499
LS
Logo Showcase Ultimate
wpWax
6.5
1%
Apr 9WordPress Logo Showcase Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerability
CVE-2025-31857
DA
Directorist AddonsKit for Elementor
wpWax
6.5
0%
Apr 1WordPress Directorist AddonsKit for Elementor plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability
CVE-2025-2224
DA
Directorist: AI-Powered Business Directory, Listings & Classified Ads
wpwax
5.3
0%
Mar 25Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing
CVE-2025-1570
DI
Directorist
Wpwax
9.8
0%
Feb 28The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions…
CVE-2024-12041
DI
Directorist
Wpwax
5.3
0%
Feb 1The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to Information Exposure in all versions up to, and…
CVE-2025-24782
PG
Post Grid, Slider & Carousel Ultimate
Wpwax
8.8
0%
Jan 27Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Post Grid, Slider & Carousel Ultimate…
CVE-2024-13409
PG
Post Grid, Slider & Carousel Ultimate
Wpwax
8.8
1%
Jan 24The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to,…
CVE-2024-29925
PG
Post Grid, Slider & Carousel Ultimate
Wpwax
5.4
0%
Mar 27Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Post Grid, Slider & Carousel Ultimate allows Stored XSS.This issue…
CVE-2023-50886
LP
Legal Pages
Wpwax
8.0
0%
Mar 15Cross-Site Request Forgery (CSRF), Incorrect Authorization vulnerability in wpWax Legal Pages.This issue affects Legal Pages: from n/a through 1.3.7
CVE-2024-2006
PG
Post Grid, Slider & Carousel Ultimate
Wpwax
8.8
1%
Mar 13The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to,…
CVE-2024-1950
PC
Product Carousel Slider & Grid Ultimate For Woocommerce
Wpwax
8.8
1%
Mar 13The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via…
CVE-2024-1322
DI
Directorist
Wpwax
5.3
1%
Feb 29The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing…
CVE-2023-2252
DI
Directorist
Wpwax
2.7
1%
Jan 16The Directorist WordPress plugin before 7.5.4 is vulnerable to Local File Inclusion as it does not validate the file parameter when importing CSV files
CVE-2023-47824
LP
Legal Pages
Wpwax
8.8
0%
Nov 22Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator plugin <= 1.3.8 versions
CVE-2023-41798
DI
Directorist
Wpwax
8.8
1%
Nov 7Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing.This issue affects…
CVE-2023-1889
DI
Directorist
Wpwax
6.5
1%
Jun 9The Directorist plugin for WordPress is vulnerable to an Insecure Direct Object Reference in versions up to, and including, 7.5.4
CVE-2023-1888
DI
Directorist
Wpwax
8.8
1%
Jun 9The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4
CVE-2022-3961
DI
Directorist
Wpwax
6.5
1%
Dec 19The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system information
CVE-2022-3930
DI
Directorist
Wpwax
6.5
1%
Dec 12The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users instead of his own
CVE-2022-2376
DI
Directorist
Wpwax
5.3
2%
Sep 5The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users
CVE-2022-2377
DI
Directorist
Wpwax
4.3
0%
Aug 22The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of…
CVE-2022-2046
DI
Directorist
Wpwax
4.9
1%
Aug 8Directorist - Business Directory Plugin < 7.2.3 - Admin+ Arbitrary File Upload
CVE-2022-34853
TE
Team
Wpwax
5.4
1%
Jul 22Multiple Authenticated (contributor or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress
CVE-2022-34650
TE
Team
Wpwax
5.4
1%
Jul 22Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress
CVE-2022-1266
PG
Post Grid, Slider & Carousel Ultimate
Wpwax
4.8
1%
Jun 20The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site…
CVE-2021-24981
DI
Directorist
Wpwax
7.5
1%
Dec 21The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins…