Skip to content
OpenAdvisories

Vendor

wpxpo

36 known vulnerabilities.

Products

PostX 10 Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX 6 Post Grid Gutenberg Blocks – PostX 4 WowStore – Store Builder & Product Blocks for WooCommerce 3 WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation 2 WowAddons 2 WowStore 2 WowOptin 1 WholesaleX – All-in-One B2B Solution with Wholesale Pricing 1 FastX 1 WowRevenue – Product Bundles & Bulk Discounts 1 PostX – Gutenberg Post Grid Blocks 1 WowRevenue 1 ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks 1
All Critical High Medium Low Exploited only Public exploit

21 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-8145

    WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration'

    The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'process_registration' due to missing validation on the 'whole…

    wpxpo WholesaleX – All-in-One B2B Solution with Wholesale Pricing Web / CMS
  • Medium 6.4
    CVE-2026-5158

    PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block

    The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlaceHolder' parameter in all versions up to, and including, 5.0.13 due to insufficient input sanitizatio…

    wpxpo Post Grid Gutenberg Blocks – PostX Web / CMS
  • Medium 6.4
    CVE-2026-17162

    WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute

    The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output …

    wpxpo WowStore – Store Builder & Product Blocks for WooCommerce Web / CMS
  • Medium 6.4
    CVE-2026-17161

    WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute

    The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and outp…

    wpxpo WowStore – Store Builder & Product Blocks for WooCommerce Web / CMS
  • Medium 6.4
    CVE-2026-15100

    Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute

    The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions up to, and including, 5.0.32 due to insufficient input sanitization and output escaping. This makes i…

    wpxpo Post Grid Gutenberg Blocks – PostX Web / CMS
  • Medium 6.5
    CVE-2026-57377

    WordPress WowAddons plugin <= 1.6.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPXPO WowAddons product-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowAddons: from n/a through <= 1.6.8.

    wpxpo WowAddons
  • Medium 6.4
    CVE-2026-13253

    Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute

    The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and…

    wpxpo Post Grid Gutenberg Blocks – PostX Web / CMS
  • Medium 4.3
    CVE-2026-2518

    FastX <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activation

    The FastX theme for WordPress is vulnerable to unauthorized limited plugin installation and activation due to missing capability checks on the 'ultp_install_callback' and 'ultp_activate_callback' functions in all versions up to, and including, 1.0.2. This mak…

    wpxpo FastX Web / CMS
  • Medium 5.3
    CVE-2026-0718

    Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification

    The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ultp_shareCount_callback() function in all versions up to, and including…

    wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX Web / CMS
  • Medium 5.3
    CVE-2026-39700

    WordPress WowOptin plugin <= 1.4.32 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPXPO WowOptin optin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowOptin: from n/a through <= 1.4.32.

    wpxpo WowOptin
  • Medium 5.3
    CVE-2025-68606

    WordPress PostX plugin <= 5.0.3 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPXPO PostX ultimate-post allows Retrieve Embedded Sensitive Data.This issue affects PostX: from n/a through <= 5.0.3.

    wpxpo PostX
  • Medium 4.3
    CVE-2025-62070

    WordPress WowRevenue plugin <= 1.2.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPXPO WowRevenue revenue.This issue affects WowRevenue: from n/a through <= 1.2.13.

    wpxpo WowRevenue
  • Medium 4.3
    CVE-2025-39571

    WordPress WowStore plugin <= 4.2.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in WPXPO WowStore product-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowStore: from n/a through <= 4.2.4.

    wpxpo WowStore
  • Medium 6.5
    CVE-2025-31096

    WordPress PostX plugin <= 4.1.25 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post allows DOM-Based XSS.This issue affects PostX: from n/a through <= 4.1.25.

    wpxpo PostX
  • Medium 4.3
    CVE-2023-45271

    WordPress ProductX – Gutenberg WooCommerce Blocks plugin <= 2.7.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPXPO WowStore product-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowStore: from n/a through <= 2.7.8.

    wpxpo WowStore
  • Medium 6.5
    CVE-2024-53818

    WordPress PostX plugin <= 4.1.15 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post.This issue affects PostX: from n/a through <= 4.1.15.

    wpxpo PostX
  • Medium 5.9
    CVE-2024-50513

    WordPress PostX plugin <= 4.1.15 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post allows Stored XSS.This issue affects PostX: from n/a through <= 4.1.15.

    wpxpo PostX
  • Medium 6.5
    CVE-2024-50443

    WordPress PostX plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post.This issue affects PostX: from n/a through <= 4.1.12.

    wpxpo PostX
  • Medium 5.4
    CVE-2024-31246

    WordPress PostX plugin <= 3.2.3 - Author+ Post/Page Duplication vulnerability

    Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 3.2.3.

    wpxpo PostX
  • Medium 6.4
    CVE-2024-5223

    Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting

    The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploading feature in all versions up to, and including, 4.1.1 due to insufficient input sanitization and o…

    wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX Web / CMS
  • Medium 6.5
    CVE-2024-32564

    WordPress PostX plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post allows DOM-Based XSS.This issue affects PostX: from n/a through <= 4.0.1.

    wpxpo PostX