Skip to content
OpenAdvisories

Vendor

stellarwp

136 known vulnerabilities.

Products

GiveWP – Donation Plugin and Fundraising Platform 34 Kadence Blocks — Page Builder Toolkit for Gutenberg Editor 30 The Events Calendar 20 GiveWP 8 Membership Plugin – Restrict Content 7 Event Tickets and Registration 7 LearnDash LMS 7 WPComplete 4 Gutenberg Blocks by Kadence Blocks 3 Kadence WooCommerce Email Designer 3 Event Tickets 3 Restrict Content 2 Bookit — Booking & Appointment Calendar 2 iThemes Sync 1 Give – Divi Donation Modules 1 LearnDash LMS – Reports 1 Membership Plugin – Kadence Memberships 1 Virtue 1 Image Widget 1
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-78006 Public exploit

    The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution

    The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed…

    stellarwp The Events Calendar Web / CMS
  • Critical 9.8
    CVE-2026-78159 Public exploit

    The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation

    The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload t…

    stellarwp The Events Calendar Web / CMS
  • Critical 9.8
    CVE-2025-22777 Public exploit

    WordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3.

    stellarwp GiveWP
  • Critical 9.8
    CVE-2024-12877 Public exploit

    GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection

    The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. This makes it possibl…

    stellarwp GiveWP – Donation Plugin and Fundraising Platform Web / CMS
  • Critical 9.8
    CVE-2024-8353 Public exploit EPSS 33%

    GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection

    The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. T…

    stellarwp GiveWP – Donation Plugin and Fundraising Platform Web / CMS
  • Critical 9.8
    CVE-2024-8275 Public exploit EPSS 50%

    The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection

    The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of su…

    stellarwp The Events Calendar Web / CMS
  • Critical 10.0
    CVE-2024-5932 Public exploit EPSS 77%

    GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution

    The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for un…

    stellarwp GiveWP – Donation Plugin and Fundraising Platform Web / CMS
  • Medium 5.3
    CVE-2024-1208 Public exploit

    LearnDash LMS <= 4.10.2 - Sensitive Information Exposure via API

    The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions.

    stellarwp LearnDash LMS Web / CMS
  • Medium 5.3
    CVE-2024-1209 Public exploit

    LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignments

    The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due to insufficient protection of uploaded assignments. This makes it possible for unauthenticated attac…

    stellarwp LearnDash LMS Web / CMS
  • Medium 5.3
    CVE-2023-47668 Public exploit

    WordPress Restrict Content Plugin <= 3.2.7 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.

    stellarwp Membership Plugin – Restrict Content