Skip to content
OpenAdvisories

Vendor

wpweaver

9 known vulnerabilities.

wpweaver at a glance

Last 12 months
3
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 1 vulnerability Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 1 vulnerability September 2026: 0 vulnerabilities Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202600
Aug 202610
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202610
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202520
Dec 202400

Products

Weaver Xtreme 2 Weaver Show Posts 2 Weaver Xtreme Theme Support 2 Turnkey bbPress by WeaverTheme 2 Weaver Themes Shortcode Compatibility 1
All Critical High Medium Low Exploited only Public exploit

9 results · Feed

  • Medium 6.5
    CVE-2026-54870

    WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1.

    wpweaver Weaver Xtreme Theme Support
  • Medium 6.6
    CVE-2026-10035

    Turnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Administrator+) PHP Object Injection

    The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function (reached through the wvrbbp_save…

    wpweaver Turnkey bbPress by WeaverTheme Web / CMS
  • Medium 4.4
    CVE-2026-2121

    Weaver Show Posts <= 1.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Additional Classes to Wrap Posts' Widget Setting

    The Weaver Show Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_class' parameter in all versions up to, and including, 1.8.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. …

    wpweaver Weaver Show Posts Web / CMS
  • Medium 6.5
    CVE-2025-22267

    WordPress Weaver Themes Shortcode Compatibility Plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Themes Shortcode Compatibility weaver-themes-shortcode-compatibility allows Stored XSS.This issue affects Weaver Themes Shortcode Compatibili…

    wpweaver Weaver Themes Shortcode Compatibility
  • Medium 6.1
    CVE-2024-12221

    Turnkey bbPress by WeaverTheme <= 1.6.3 - Reflected Cross-Site Scripting via _wpnonce Parameter

    The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘_wpnonce’ parameter in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible…

    wpweaver Turnkey bbPress by WeaverTheme Web / CMS
  • Medium 6.4
    CVE-2024-4939

    Weaver Xtreme Theme Support <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via div Shortcode

    The Weaver Xtreme Theme Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's div shortcode in all versions up to, and including, 6.4 due to insufficient input sanitization and output escaping on user supplied attributes. …

    wpweaver Weaver Xtreme Theme Support Web / CMS
  • Medium 5.4
    CVE-2023-6990

    Weaver Xtreme <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Weaver Xtreme theme for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user supplied meta (page-head-code). This makes i…

    wpweaver Weaver Xtreme Web / CMS
  • Medium 6.4
    CVE-2023-1404

    Weaver Show Posts <= 1.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name

    The Weaver Show Posts Plugin for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to, and including, 1.6. This makes it possible for authenticated attackers with contributor-level a…

    wpweaver Weaver Show Posts Web / CMS
  • Medium 6.4
    CVE-2023-1403

    Weaver Xtreme Theme <= 5.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name

    The Weaver Xtreme Theme for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to, and including, 5.0.7. This makes it possible for authenticated attackers with contributor-level and …

    wpweaver Weaver Xtreme Web / CMS