Skip to content
OpenAdvisories

Vendor

wpopal

16 known vulnerabilities.

Products

Opal Estate 2 Opal Estate Pro – Property Management and Submission 2 Opal Membership 2 Opal Woo Custom Product Variation 2 Opal Service 1 GG Woo Feed for WooCommerce Shopping Feed on Google and Other Channels 1 Wpopal Core Features 1 Opal Hotel Room Booking (WordPress plugin) 1 GG Bought Together for WooCommerce 1 Opal Widgets For Elementor 1 GutenGeek Free Gutenberg Blocks for WordPress 1 Opal Portfolio 1
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-62913

    WordPress Opal Service plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpopal Opal Service opal-service allows Stored XSS.This issue affects Opal Service: from n/a through <= 1.9.1.

    wpopal Opal Service
  • Medium 6.5
    CVE-2025-31748

    WordPress Opal Portfolio Plugin <= 1.0.4 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpopal Opal Portfolio opal-portfolios allows Stored XSS.This issue affects Opal Portfolio: from n/a through <= 1.0.4.

    wpopal Opal Portfolio
  • Medium 6.4
    CVE-2024-9073

    GutenGeek Free Gutenberg Blocks for WordPress <= 1.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

    The GutenGeek Free Gutenberg Blocks for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it poss…

    wpopal GutenGeek Free Gutenberg Blocks for WordPress Web / CMS
  • Medium 6.1
    CVE-2024-7649

    Opal Membership <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting

    The Opal Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via checkout form fields in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated a…

    wpopal Opal Membership Web / CMS
  • Medium 4.3
    CVE-2024-7648

    Opal Membership <= 1.2.4 - Authenticated (Subscriber+) Information Disclosure

    The Opal Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the private notes functionality on payments which utilizes WordPress comments. This makes it possible for authenticated at…

    wpopal Opal Membership Web / CMS
  • Medium 6.4
    CVE-2024-3666

    Opal Estate Pro – Property Management and Submission <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Opal Estate Pro – Property Management and Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the agent latitude and longitude parameters in all versions up to, and including, 1.7.6 due to insufficient input sanitization and o…

    wpopal Opal Estate Pro – Property Management and Submission Web / CMS
  • Medium 6.5
    CVE-2024-33649

    WordPress Opal Widgets For Elementor plugin <= 1.6.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpOpal Opal Widgets For Elementor allows Stored XSS.This issue affects Opal Widgets For Elementor: from n/a through 1.6.9.

    wpopal Opal Widgets For Elementor
  • Medium 6.5
    CVE-2023-6638

    GTG Product Feed for Shopping <= 1.2.4 - Missing Authorization to Unauthenticated Plugin Settings Update

    The GTG Product Feed for Shopping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_settings' function in versions up to, and including, 1.2.4. This makes it possible for unauthenticated a…

    wpopal GG Woo Feed for WooCommerce Shopping Feed on Google and Other Channels Web / CMS
  • Medium 4.3
    CVE-2021-4388

    Opal Estate <= 1.6.11 - Missing Authorization

    The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due to missing capability checks on the opalestate_set_feature_property() and opalestate_remove_feature_property() function…

    wpopal Opal Estate Web / CMS
  • Medium 4.3
    CVE-2021-4387

    Opal Estate <= 1.6.11 - Cross-Site Request Forgery Bypass

    The Opal Estate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.11. This is due to missing or incorrect nonce validation on the opalestate_set_feature_property() and opalestate_remove_feature_property() f…

    wpopal Opal Estate Web / CMS
  • Medium 4.1
    CVE-2022-29449

    WordPress Opal Hotel Room Booking plugin <= 1.2.7 - Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Opal Hotel Room Booking plugin <= 1.2.7 at WordPress.

    wpopal Opal Hotel Room Booking (WordPress plugin) Web / CMS