Skip to content
OpenAdvisories

Vendor

stellarwp

136 known vulnerabilities.

Products

GiveWP – Donation Plugin and Fundraising Platform 34 Kadence Blocks — Page Builder Toolkit for Gutenberg Editor 30 The Events Calendar 20 GiveWP 8 Membership Plugin – Restrict Content 7 Event Tickets and Registration 7 LearnDash LMS 7 WPComplete 4 Gutenberg Blocks by Kadence Blocks 3 Kadence WooCommerce Email Designer 3 Event Tickets 3 Restrict Content 2 Bookit — Booking & Appointment Calendar 2 iThemes Sync 1 Give – Divi Donation Modules 1 LearnDash LMS – Reports 1 Membership Plugin – Kadence Memberships 1 Virtue 1 Image Widget 1
All Critical High Medium Low Exploited only Public exploit

101 results · Clear filters · Feed

  • Medium 6.4
    CVE-2024-4034

    Virtue <= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author

    The Virtue theme for WordPress is vulnerable to Stored Cross-Site Scripting via a Post Author's name in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping when the latest posts feature is enabled on the homepag…

    stellarwp Virtue Web / CMS
  • Medium 5.3
    CVE-2024-31432

    WordPress Restrict Content plugin <= 3.2.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in StellarWP Restrict Content.This issue affects Restrict Content: from n/a through 3.2.8.

    stellarwp Restrict Content
  • Medium 4.3
    CVE-2024-31433

    WordPress The Events Calendar plugin <= 6.3.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar.This issue affects The Events Calendar: from n/a through <= 6.3.0.

    stellarwp The Events Calendar
  • Medium 6.4
    CVE-2024-1957

    GiveWP – Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

    The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escapi…

    stellarwp GiveWP – Donation Plugin and Fundraising Platform Web / CMS
  • Medium 6.4
    CVE-2024-1424

    GiveWP – Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping on use…

    stellarwp GiveWP – Donation Plugin and Fundraising Platform Web / CMS
  • Medium 6.4
    CVE-2024-1999

    Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget

    The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget's anchor style parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitiz…

    stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Web / CMS
  • Medium 4.4
    CVE-2024-0598

    Gutenberg Blocks by Kadence Blocks <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings

    The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contact form message settings in all versions up to and including 3.2.17 due to insufficient input sanitization and output…

    stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Web / CMS
  • Medium 4.3
    CVE-2024-2261

    Event Tickets and Registration <= 5.8.2 - Improper Authorization to Information Disclosure

    The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.8.2 via the RSVP functionality. This makes it possible for authenticated attackers, with contributor access and abo…

    stellarwp Event Tickets and Registration Web / CMS
  • Medium 6.4
    CVE-2024-2919

    Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via CountUp Widget

    The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CountUp Widget in all versions up to, and including, 3.2.31 due to insufficient input sanitization and output escaping on …

    stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Web / CMS
  • Medium 6.4
    CVE-2024-24888

    WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.2.25 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through <= 3.2.25.

    stellarwp Gutenberg Blocks by Kadence Blocks
  • Medium 6.4
    CVE-2024-1541

    Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the htmlTag attribute in all versions up to, and including, 3.2.23 due to insufficient input sanitization and output escaping.…

    stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Web / CMS
  • Medium 4.3
    CVE-2024-1053

    Event Tickets and Registration <= 5.8.1 - Missing Authorization

    The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in all versions up to, and including, 5.8.1. This makes it possible for authenticated attackers, with …

    stellarwp Event Tickets and Registration Web / CMS
  • Medium 5.3
    CVE-2023-6557

    The Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information Exposure

    The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 via the route function hooked into wp_ajax_nopriv_tribe_dropdown. This makes it possible for unauthenticated attackers t…

    stellarwp The Events Calendar Web / CMS
  • Medium 5.3
    CVE-2024-1208 Public exploit Scanner template

    LearnDash LMS <= 4.10.2 - Sensitive Information Exposure via API

    The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions.

    stellarwp LearnDash LMS Web / CMS
  • Medium 5.3
    CVE-2024-1209 Public exploit Scanner template

    LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignments

    The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due to insufficient protection of uploaded assignments. This makes it possible for unauthenticated attac…

    stellarwp LearnDash LMS Web / CMS
  • Medium 5.3
    CVE-2024-1210 Scanner template

    LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via API

    The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via API. This makes it possible for unauthenticated attackers to obtain access to quizzes.

    stellarwp LearnDash LMS Web / CMS
  • Medium 5.4
    CVE-2023-4247

    GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivation

    The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_disconnect function. This makes it possible for unauthenticated attac…

    stellarwp GiveWP – Donation Plugin and Fundraising Platform Web / CMS
  • Medium 4.3
    CVE-2023-4246

    GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin installation

    The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_remote_install_handler function. This makes it possible for unauthent…

    stellarwp GiveWP – Donation Plugin and Fundraising Platform Web / CMS
  • Medium 5.4
    CVE-2023-4248

    GiveWP <= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion

    The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_stripe_disconnect_connect_stripe_account function. This makes it possible fo…

    stellarwp GiveWP – Donation Plugin and Fundraising Platform Web / CMS
  • Medium 5.3
    CVE-2023-47668 Public exploit

    WordPress Restrict Content Plugin <= 3.2.7 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.

    stellarwp Membership Plugin – Restrict Content
  • Medium 5.3
    CVE-2022-2117

    GiveWP – Donation Plugin and Fundraising Platform <= 2.20.2 - Sensitive Information Disclosure

    The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoint which provides unauthenticated users with donor information even when the donor wall is not enable…

    stellarwp GiveWP – Donation Plugin and Fundraising Platform Web / CMS