stellarwp

12 results · Clear filters · Feed

• Critical 9.8
  CVE-2026-78006 Public exploit

  The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution

  The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed…

  stellarwp The Events Calendar Web / CMS
  Sep 12, 2026
• Critical 9.8
  CVE-2026-78159 Public exploit

  The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation

  The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload t…

  stellarwp The Events Calendar Web / CMS
  Sep 12, 2026
• Critical 9.3
  CVE-2026-9273

  Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover

  The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handle…

  stellarwp Membership Plugin – Kadence Memberships Web / CMS
  Aug 5, 2026
• Critical 9.1
  CVE-2025-39557

  WordPress Kadence WooCommerce Email Designer plugin <= 1.5.14 - Arbitrary File Upload vulnerability

  Unrestricted Upload of File with Dangerous Type vulnerability in StellarWP Kadence WooCommerce Email Designer kadence-woocommerce-email-designer allows Upload a Web Shell to a Web Server.This issue affects Kadence WooCommerce Email Designer: from n/a through …

  stellarwp Kadence WooCommerce Email Designer Web / CMS
  Apr 16, 2025
• Critical 9.8
  CVE-2025-0912

  GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection

  The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'card_address' parameter. This makes it possible for unauthe…

  stellarwp GiveWP – Donation Plugin and Fundraising Platform Web / CMS
  Mar 4, 2025
• Critical 9.8
  CVE-2025-22777 Public exploit

  WordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerability

  Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3.

  stellarwp GiveWP
  Jan 13, 2025
• Critical 9.8
  CVE-2024-12877 Public exploit

  GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection

  The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. This makes it possibl…

  stellarwp GiveWP – Donation Plugin and Fundraising Platform Web / CMS
  Jan 11, 2025
• Critical 9.8
  CVE-2024-9634

  GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution

  The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 via deserialization of untrusted input from the give_company_name parameter. This makes it possible f…

  stellarwp GiveWP – Donation Plugin and Fundraising Platform Web / CMS
  Oct 16, 2024
• Critical 9.8
  CVE-2024-8353 Public exploit Scanner template EPSS 33%

  GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection

  The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. T…

  stellarwp GiveWP – Donation Plugin and Fundraising Platform Web / CMS
  Sep 28, 2024
• Critical 9.8
  CVE-2024-8275 Public exploit EPSS 50%

  The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection

  The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of su…

  stellarwp The Events Calendar Web / CMS
  Sep 25, 2024
• Critical 10.0
  CVE-2024-5932 Public exploit Scanner template EPSS 77%

  GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution

  The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for un…

  stellarwp GiveWP – Donation Plugin and Fundraising Platform Web / CMS
  Aug 20, 2024
• Critical 9.8
  CVE-2023-2834

  BookIt <= 2.3.7 - Authentication Bypass

  The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for un…

  stellarwp Bookit — Booking & Appointment Calendar Web / CMS
  Jun 30, 2023