Skip to content
OpenAdvisories

Vendor

ShapedPlugin

24 known vulnerabilities.

Products

Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel 4 Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials 3 Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ 2 Quick View for WooCommerce 2 WP Tabs – Responsive Tabs Plugin for WordPress 2 Real Testimonials 2 Product Slider Pro for WooCommerce 1 Location Weather 1 Widget Post Slider 1 Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News 1 Category Slider for WooCommerce 1 Location Weather – WordPress Weather Forecast, AQI, Temperature and Weather Widget 1 Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts 1 Easy Accordion – Responsive Accordion FAQ Builder and Product FAQ 1 WP Tabs 1
All Critical High Medium Low Exploited only Public exploit

19 results · Clear filters · Feed

  • Medium 4.7
    CVE-2026-120509

    Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter

    The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tpro_client_name' parameter in all versions up to, and including, 4.1.0 due to insufficient …

    ShapedPlugin Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials Web / CMS
  • Medium 5.4
    CVE-2026-120685

    Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chain

    The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tpro_client_image (JPEG IPTC caption) + tpro_client_testimonial ([gallery] shortcode)' param…

    ShapedPlugin Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials Web / CMS
  • Medium 5.4
    CVE-2026-120683

    Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parameter

    The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tpro_client_testimonial' parameter in all versions up to, and including, 4.1.0 due to insuff…

    ShapedPlugin Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials Web / CMS
  • Medium 6.4
    CVE-2026-119160

    Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block

    The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.9 due to insufficient input sa…

    ShapedPlugin Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News Web / CMS
  • Medium 6.4
    CVE-2026-18988

    Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute

    The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordion_heade…

    ShapedPlugin Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ Web / CMS
  • Medium 6.5
    CVE-2026-66433

    WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.

    ShapedPlugin Location Weather
  • Medium 6.4
    CVE-2026-15652

    Easy Accordion <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block Attribute

    The Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'align' Block Attribute in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output esc…

    ShapedPlugin Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ Web / CMS
  • Medium 4.3
    CVE-2026-7249

    Location Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging

    The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the `splw_update_block_options()` and `lwp_clean_weather_transients()` functions in all versions up to, and including, 3.0.2. This…

    ShapedPlugin Location Weather – WordPress Weather Forecast, AQI, Temperature and Weather Widget Web / CMS
  • Medium 6.4
    CVE-2026-4665

    WP Carousel Free <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute

    The WP Carousel Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted fancybox `data-caption` attributes in all versions up to, and including, 2.7.10. This is due to the `fancybox-config.js` script reading the carousel container's…

    ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel Web / CMS
  • Medium 5.3
    CVE-2025-12584

    Quick View for WooCommerce <= 2.2.17 - Unauthenticated Private Product Disclosure

    The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqv_popup_content' AJAX endpoint due to insufficient restrictions on which products can be included. This makes it …

    ShapedPlugin Quick View for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-58228

    WordPress Quick View for WooCommerce Plugin <= 2.2.16 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC Quick View for WooCommerce woo-quickview allows Stored XSS.This issue affects Quick View for WooCommerce: from n/a through <= 2.2.16.

    ShapedPlugin Quick View for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-22269

    WordPress Real Testimonials plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Stored XSS.This issue affects Real Testimonials: from n/a through <= 3.1.6.

    ShapedPlugin Real Testimonials
  • Medium 4.3
    CVE-2023-41132

    WordPress Category Slider for WooCommerce plugin <= 1.4.15 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ShapedPlugin LLC Category Slider for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Category Slider for WooCommerce: from n/a through 1.4.15.

    ShapedPlugin Category Slider for WooCommerce Web / CMS
  • Medium 6.4
    CVE-2024-5020

    Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library

    Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attribu…

    smub 10web jetmonsters posimyththemes Web / CMS
  • Medium 5.9
    CVE-2024-32801

    WordPress Widget Post Slider plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin Widget Post Slider allows Stored XSS.This issue affects Widget Post Slider: from n/a through 1.3.5.

    ShapedPlugin Widget Post Slider
  • Medium 6.4
    CVE-2024-2949

    Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sp_wp_carousel_shortcode'

    The Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the carousel widget in all versions…

    ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel Web / CMS
  • Medium 6.4
    CVE-2024-1363

    Easy Accordion – Best Accordion FAQ Plugin for WordPress <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Easy Accordion – Best Accordion FAQ Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordion_content_source' attribute in all versions up to, and including, 2.3.4 due to insufficient input sanitization and …

    ShapedPlugin Easy Accordion – Responsive Accordion FAQ Builder and Product FAQ Web / CMS
  • Medium 6.5
    CVE-2023-52124

    WordPress WP Tabs Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC WP Tabs – Responsive Tabs Plugin for WordPress allows Stored XSS.This issue affects WP Tabs – Responsive Tabs Plugin for WordPress: from n/a…

    ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress Web / CMS
  • Medium 5.4
    CVE-2023-25065

    WordPress WP Tabs Plugin <= 2.1.14 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress plugin <= 2.1.14 versions.

    ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress Web / CMS