Skip to content
OpenAdvisories

Vendor

wpdive

10 known vulnerabilities.

wpdive at a glance

Last 12 months
6
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 2 vulnerabilities Dec 2025 January 2026: 1 vulnerability February 2026: 0 vulnerabilities March 2026: 2 vulnerabilities, 1 critical Mar April 2026: 0 vulnerabilities May 2026: 1 vulnerability June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202610
Apr 202600
Mar 202621
Feb 202600
Jan 202610
Dec 202520
Nov 202500
Oct 202500
Sep 202510
Aug 202500
Jul 202500
Jun 202520
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Nexa Blocks 3 Better Addons for Elementor 2 Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE 2 ElementCamp 2 Better Elementor Addons 1
All Critical High Medium Low Exploited only Public exploit

10 results · Feed

  • Medium 5.4
    CVE-2026-6394

    Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter

    The Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in versions up to and including 1.1.1. This is due to the import_demo() function accepting a user-supplied URL…

    wpdive Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Web / CMS
  • Critical 9.8
    CVE-2026-25429

    WordPress Nexa Blocks plugin <= 1.1.1 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1.1.1.

    wpdive Nexa Blocks
  • Medium 6.5
    CVE-2026-2503

    ElementCamp <= 2.3.6 - Authenticated (Author+) SQL Injection via 'meta_query[compare]' Parameter

    The ElementCamp plugin for WordPress is vulnerable to time-based SQL Injection via the 'meta_query[compare]' parameter in the 'tcg_select2_search_post' AJAX action in all versions up to, and including, 2.3.6. This is due to the user-supplied compare value bei…

    wpdive ElementCamp Web / CMS
  • Medium 5.3
    CVE-2026-24556

    WordPress ElementCamp plugin <= 2.3.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpdive ElementCamp element-camp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementCamp: from n/a through <= 2.3.2.

    wpdive ElementCamp
  • Medium 5.4
    CVE-2023-41656

    WordPress Better Elementor Addons plugin <= 1.3.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpdive Better Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Elementor Addons: from n/a through 1.3.7.

    wpdive Better Elementor Addons
  • Medium 6.4
    CVE-2025-12830

    Better Elementor Addons <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Widget

    The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider widget in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes …

    wpdive Better Addons for Elementor Web / CMS
  • Medium 6.4
    CVE-2025-8624

    Nexa Blocks <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Widget

    The Nexa Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Google Maps widget in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This make…

    wpdive Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Web / CMS
  • Medium 6.5
    CVE-2025-30952

    WordPress Nexa Blocks plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdive Nexa Blocks nexa-blocks allows Stored XSS.This issue affects Nexa Blocks: from n/a through <= 1.1.0.

    wpdive Nexa Blocks
  • Medium 4.9
    CVE-2025-30976

    WordPress Nexa Blocks plugin <= 1.1.1 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in wpdive Nexa Blocks nexa-blocks allows Server Side Request Forgery.This issue affects Nexa Blocks: from n/a through <= 1.1.1.

    wpdive Nexa Blocks
  • Medium 6.4
    CVE-2024-2280

    Better Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links

    The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget link URL values in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. Th…

    wpdive Better Addons for Elementor Web / CMS