Log in Start free

StellarWP

Products

ProductCVEsExploitedLatest
GiveWP – Donation Plugin and Fundraising Platform34–Nov 5, 2026
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor30–Oct 10, 2026
The Events Calendar20–Sep 12, 2026
GiveWP8–Apr 29, 2026
Membership Plugin – Restrict Content7–Mar 20, 2026
Event Tickets and Registration7–Oct 2, 2026
LearnDash LMS7–Sep 5, 2026
WPComplete4–Sep 19, 2026
Kadence WooCommerce Email Designer3–Dec 2, 2025
Event Tickets3–Oct 22, 2025
Gutenberg Blocks by Kadence Blocks3–Jan 24, 2025
Restrict Content2–Mar 25, 2026
Bookit — Booking & Appointment Calendar2–Nov 12, 2025
Virtue1–May 2, 2024
Membership Plugin – Kadence Memberships1–Aug 5, 2026
Image Widget1–Apr 29, 2026
LearnDash LMS – Reports1–Jul 9, 2024
iThemes Sync1–Feb 19, 2026
Give – Divi Donation Modules1–Feb 23, 2025

Exploited and recent CVEs

  • CVE-2026-118193 High 8.8 GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter 0.4%
  • CVE-2026-97643 Medium 6.4 GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes 0.2%
  • CVE-2026-104762 Medium 6.4 Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute 0.2%
  • CVE-2026-97634 Medium 6.5 Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter 0.3%
  • CVE-2026-77820 Medium 6.4 WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute 0.3%
  • CVE-2026-78159 Critical 9.8 The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation 1.4%
  • CVE-2026-78006 Critical 9.8 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution 1.5%
  • CVE-2026-3174 High 7.5 Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update 0.5%
  • CVE-2026-12843 Medium 5.4 LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint 0.3%
  • CVE-2026-12483 High 7.5 LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler 0.6%
  • CVE-2026-5510 Medium 6.4 GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes 0.4%
  • CVE-2026-9273 Critical 9.3 Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover 0.5%
  • CVE-2026-18062 Medium 6.4 Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content 0.4%
  • CVE-2026-18435 Medium 6.4 Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute 0.3%
  • CVE-2026-14987 Medium 6.4 GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting 0.4%
  • CVE-2026-15286 Medium 4.3 Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication 0.4%
  • CVE-2026-13704 Medium 6.4 GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form 0.4%
  • CVE-2026-11981 Medium 4.3 GiveWP <= 4.15.3 - Cross-Site Request Forgery 0.2%
  • CVE-2026-12902 Medium 4.3 Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions 0.5%
  • CVE-2026-12904 Medium 4.3 Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter 0.5%
  • CVE-2026-13246 Medium 6.4 GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute 0.4%
  • CVE-2026-11357 Medium 4.3 Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization 0.3%
  • CVE-2026-42642 Medium 5.3 WordPress GiveWP plugin <= 4.14.5 - Broken Access Control vulnerability 0.2%
  • CVE-2026-42643 Medium 5.9 WordPress Image Widget plugin <= 4.4.11 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2026-2826 Medium 4.3 Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload 0.3%
  • CVE-2026-32546 High 7.5 WordPress Restrict Content plugin <= 3.2.22 - Broken Access Control vulnerability 0.2%
  • CVE-2026-3079 Medium 6.5 LearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter 0.3%
  • CVE-2026-4136 Medium 4.3 Membership Plugin – Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirect 0.2%
  • CVE-2026-3585 High 7.5 The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import 0.4%
  • CVE-2026-1321 High 8.1 Membership Plugin – Restrict Content <= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp_level' 0.4%