Skip to content
OpenAdvisories

Vendor

wpxpo

36 known vulnerabilities.

Products

PostX 10 Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX 6 Post Grid Gutenberg Blocks – PostX 4 WowStore – Store Builder & Product Blocks for WooCommerce 3 WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation 2 WowAddons 2 WowStore 2 WowOptin 1 WholesaleX – All-in-One B2B Solution with Wholesale Pricing 1 FastX 1 WowRevenue – Product Bundles & Bulk Discounts 1 PostX – Gutenberg Post Grid Blocks 1 WowRevenue 1 ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks 1
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • High 7.2
    CVE-2026-96840

    Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field

    The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible…

    wpxpo Post Grid Gutenberg Blocks – PostX Web / CMS
  • High 7.1
    CVE-2026-57686

    WordPress WowAddons plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WowAddons <= 1.6.14 versions.

    wpxpo WowAddons
  • High 7.2
    CVE-2026-4302

    WowOptin: Next-Gen Popup Maker <= 1.4.29 - Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API

    The WowOptin: Next-Gen Popup Maker plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.29. This is due to the plugin exposing a publicly accessible REST API endpoint (optn/v1/integration-action) with a p…

    wpxpo WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation Web / CMS
  • High 7.5
    CVE-2026-2579

    WowStore – Store Builder & Product Blocks for WooCommerce <= 4.4.3 - Unauthenticated SQL Injection via 'search' Parameter

    The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 4.4.3 due to insufficient escaping on the user supplied parameter and lack of su…

    wpxpo WowStore – Store Builder & Product Blocks for WooCommerce Web / CMS
  • High 8.8
    CVE-2026-1720

    WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation <= 1.4.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation

    The WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the 'install_and_active_plugin' function in all ve…

    wpxpo WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation Web / CMS
  • High 7.2
    CVE-2026-1273

    PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints

    The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.8 via the `/ultp/v3/starter_dummy_post/` and `/ultp/v3/starter_import_content…

    wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX Web / CMS
  • High 8.8
    CVE-2026-2001

    WowRevenue <= 2.1.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

    The WowRevenue plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'Notice::install_activate_plugin' function in all versions up to, and including, 2.1.3. This makes it possible for authenticated att…

    wpxpo WowRevenue – Product Bundles & Bulk Discounts Web / CMS
  • High 7.5
    CVE-2025-69313

    WordPress PostX plugin <= 5.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 5.0.3.

    wpxpo PostX
  • High 7.5
    CVE-2025-12980

    Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure

    The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the '/ultp/v2/get_dynamic_content/' REST API endpoint in all versions up to, and i…

    wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX Web / CMS
  • High 7.2
    CVE-2025-55707

    WordPress PostX Plugin <= 4.1.35 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in WPXPO PostX ultimate-post allows Privilege Escalation.This issue affects PostX: from n/a through <= 4.1.35.

    wpxpo PostX
  • High 7.1
    CVE-2025-54751

    WordPress PostX plugin <= 4.1.36 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 4.1.36.

    wpxpo PostX
  • High 8.8
    CVE-2024-10728 Public exploit EPSS 39%

    PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation

    The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the 'install_required_plugin_callback' function in all versions up to, and …

    wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX Web / CMS
  • High 8.8
    CVE-2024-5326 Public exploit

    Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update

    The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'postx_presets_callback' function in all versions up to, and including, 4.1.2. Th…

    wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX Web / CMS
  • High 8.7
    CVE-2024-23512

    WordPress ProductX – Gutenberg WooCommerce Blocks Plugin <= 3.1.4 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in wpxpo ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks.This issue affects ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks: from n/a through 3.1.4.

    wpxpo ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks Web / CMS
  • High 7.1
    CVE-2023-36385

    WordPress PostX – Gutenberg Blocks for Post Grid Plugin <= 2.9.9 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpxpo PostX – Gutenberg Post Grid Blocks plugin <= 2.9.9 versions.

    wpxpo PostX – Gutenberg Post Grid Blocks