Skip to content
OpenAdvisories

Vendor

ShapedPlugin

24 known vulnerabilities.

Products

Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel 4 Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials 3 Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ 2 Quick View for WooCommerce 2 WP Tabs – Responsive Tabs Plugin for WordPress 2 Real Testimonials 2 Product Slider Pro for WooCommerce 1 Location Weather 1 Widget Post Slider 1 Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News 1 Category Slider for WooCommerce 1 Location Weather – WordPress Weather Forecast, AQI, Temperature and Weather Widget 1 Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts 1 Easy Accordion – Responsive Accordion FAQ Builder and Product FAQ 1 WP Tabs 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.2
    CVE-2026-59521

    WordPress Real Testimonials plugin <= 3.1.15 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through <= 3.1.15.

    ShapedPlugin Real Testimonials
  • High 7.2
    CVE-2026-3017

    Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object Injection

    The Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.12 via deserialization of untrusted input in the import_shortcodes() function…

    ShapedPlugin Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts Web / CMS
  • High 7.2
    CVE-2025-48134

    WordPress WP Tabs plugin <= 2.2.12 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC WP Tabs wp-expand-tabs-free allows Object Injection.This issue affects WP Tabs: from n/a through <= 2.2.12.

    ShapedPlugin WP Tabs
  • High 7.2
    CVE-2024-3020

    Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Admin+) PHP Object Injection

    The plugin is vulnerable to PHP Object Injection in versions up to and including, 2.6.3 via deserialization of untrusted input in the import function via the 'shortcode' parameter. This allows authenticated attackers, with administrator-level access to inject…

    ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel