Log in Start free

Roxnor

Products

ProductCVEsExploitedLatest
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor23–Jan 24, 2026
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor19–May 5, 2026
WP Ultimate Review6–Oct 3, 2026
Wp Social Login and Register Social Counter6–Oct 31, 2026
FundEngine6–Aug 20, 2026
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers5–Feb 10, 2026
EmailKit – Email Customizer for WooCommerce & WP4–May 5, 2026
ElementsKit Elementor addons Lite3–Sep 23, 2026
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution3–Dec 3, 2025
FundEngine – Donation and Crowdfunding Platform3–Aug 25, 2026
GetGenie3–Jul 27, 2026
GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools3–Mar 13, 2026
Metform3–Mar 27, 2025
PopupKit2–Dec 30, 2025
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets2–Sep 15, 2026
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor1–Aug 25, 2026
EmailKit1–Sep 26, 2025
Rox Appointment Booking – Event, Calendar & Appointment Scheduling1–Oct 31, 2026

Exploited and recent CVEs

  • CVE-2026-103898 High 8.1 Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback 0.4%
  • CVE-2026-104012 High 8.8 Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint 0.3%
  • CVE-2026-100157 Medium 6.5 WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode) 0.3%
  • CVE-2026-103519 Medium 5.4 WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter 0.3%
  • CVE-2026-97344 Medium 6.4 Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write 0.2%
  • CVE-2026-94500 Medium 6.5 WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-92235 High 8.1 WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter 0.4%
  • CVE-2026-85575 Medium 6.4 The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter 0.3%
  • CVE-2026-75971 High 7.2 ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes 0.6%
  • CVE-2026-18100 Medium 6.4 MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting 0.4%
  • CVE-2026-76063 Medium 6.4 FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter 0.3%
  • CVE-2026-75930 Medium 4.3 FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter 0.4%
  • CVE-2026-73993 Critical 9.8 WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability 0.6%
  • CVE-2026-32470 Critical 9.8 WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability 0.6%
  • CVE-2026-65440 High 7.1 WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-59560 Medium 6.5 WordPress FundEngine plugin <= 1.7.8 - Broken Access Control vulnerability 0.4%
  • CVE-2026-57406 Medium 6.5 WordPress FundEngine plugin <= 1.7.6 - Broken Access Control vulnerability 0.3%
  • CVE-2026-57316 Medium 6.5 WordPress GetGenie plugin <= 4.4.2 - Sensitive Data Exposure vulnerability 0.4%
  • CVE-2026-4362 Medium 6.5 ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite 0.4%
  • CVE-2026-5957 Medium 6.5 EmailKit <= 1.6.5 - Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter 0.6%
  • CVE-2026-39644 Medium 5.3 WordPress Wp Ultimate Review plugin <= 2.3.8 - Broken Access Control vulnerability 0.2%
  • CVE-2026-2600 Medium 6.4 ElementsKit Elementor Addons and Templates <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget 0.3%
  • CVE-2026-3474 Medium 4.9 EmailKit <= 1.6.3 - Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter 0.4%
  • CVE-2026-2879 Medium 5.4 GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion 0.3%
  • CVE-2026-2257 Medium 6.4 GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API 0.2%
  • CVE-2026-23693 Critical 10.0 ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint 1.3%
  • CVE-2026-1925 Medium 4.3 EmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification 0.3%
  • CVE-2025-14895 Medium 5.4 PopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion 0.3%
  • CVE-2025-13192 High 8.2 Popup builder with Gamification <= 2.2.0 - Unauthenticated SQL Injection via Multiple REST API Endpoints 0.4%
  • CVE-2026-0633 Low 3.7 MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value 0.2%