ShapedPlugin
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel | 4 | – | May 5, 2026 |
| Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ | 2 | – | Aug 8, 2026 |
| Easy Accordion – Responsive Accordion FAQ Builder and Product FAQ | 1 | – | Mar 13, 2024 |
| Location Weather – WordPress Weather Forecast, AQI, Temperature and Weather Widget | 1 | – | May 22, 2026 |
| Quick View for WooCommerce | 1 | – | Nov 27, 2025 |
| Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News | 1 | – | Oct 31, 2026 |
| Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts | 1 | – | Apr 14, 2026 |
| Widget Post Slider | 1 | – | Apr 24, 2024 |
| WP Tabs – Responsive Tabs Plugin for WordPress | 1 | – | Feb 14, 2023 |
Exploited and recent CVEs
- CVE-2026-119160 Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block 0.2%
- CVE-2026-18988 Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute 0.3%
- CVE-2026-15652 Easy Accordion <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block Attribute 0.3%
- CVE-2026-7249 Location Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging 0.2%
- CVE-2026-4665 WP Carousel Free <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute 0.3%
- CVE-2026-3017 Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object Injection 0.5%
- CVE-2025-12584 Quick View for WooCommerce <= 2.2.17 - Unauthenticated Private Product Disclosure 0.3%
- CVE-2024-5020 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library 0.4%
- CVE-2024-32801 WordPress Widget Post Slider plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability 0.3%
- CVE-2024-3020 Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Admin+) PHP Object Injection 1.0%
- CVE-2024-2949 Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sp_wp_carousel_shortcode' 0.3%
- CVE-2024-1363 Easy Accordion – Best Accordion FAQ Plugin for WordPress <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.4%
- CVE-2023-25065 WordPress WP Tabs Plugin <= 2.1.14 is vulnerable to Cross Site Request Forgery (CSRF) 0.3%