Log in Start free

WPXPO

Products

ProductCVEsExploitedLatest
PostX10–Jan 22, 2026
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX6–Apr 16, 2026
Post Grid Gutenberg Blocks – PostX4–Oct 10, 2026
WowStore – Store Builder & Product Blocks for WooCommerce3–Jul 29, 2026
WowAddons2–Jul 13, 2026
WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation2–Mar 21, 2026
WowStore2–Apr 16, 2025
FastX1–May 22, 2026
WowOptin1–Apr 8, 2026
PostX – Gutenberg Post Grid Blocks1–Jul 25, 2023
WowRevenue1–Oct 22, 2025
WowRevenue – Product Bundles & Bulk Discounts1–Feb 16, 2026
ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks1–Feb 12, 2024
WholesaleX – All-in-One B2B Solution with Wholesale Pricing1–Oct 15, 2026

Exploited and recent CVEs

  • CVE-2026-8145 Medium 5.4 WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration' 0.2%
  • CVE-2026-96840 High 7.2 Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field 0.2%
  • CVE-2026-5158 Medium 6.4 PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block 0.3%
  • CVE-2026-17161 Medium 6.4 WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute 0.3%
  • CVE-2026-17162 Medium 6.4 WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute 0.3%
  • CVE-2026-15100 Medium 6.4 Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute 0.3%
  • CVE-2026-57377 Medium 6.5 WordPress WowAddons plugin <= 1.6.8 - Broken Access Control vulnerability 0.3%
  • CVE-2026-13253 Medium 6.4 Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute 0.4%
  • CVE-2026-57686 High 7.1 WordPress WowAddons plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-2518 Medium 4.3 FastX <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activation 0.2%
  • CVE-2026-0718 Medium 5.3 Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification 0.3%
  • CVE-2026-39700 Medium 5.3 WordPress WowOptin plugin <= 1.4.32 - Broken Access Control vulnerability 0.2%
  • CVE-2026-4302 High 7.2 WowOptin: Next-Gen Popup Maker <= 1.4.29 - Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API 0.3%
  • CVE-2026-2579 High 7.5 WowStore – Store Builder & Product Blocks for WooCommerce <= 4.4.3 - Unauthenticated SQL Injection via 'search' Parameter 0.3%
  • CVE-2026-1720 High 8.8 WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation <= 1.4.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation 0.3%
  • CVE-2026-1273 High 7.2 PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints 0.3%
  • CVE-2026-2001 High 8.8 WowRevenue <= 2.1.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation 0.4%
  • CVE-2025-69313 High 7.5 WordPress PostX plugin <= 5.0.3 - Broken Access Control vulnerability 0.3%
  • CVE-2025-68606 Medium 5.3 WordPress PostX plugin <= 5.0.3 - Sensitive Data Exposure vulnerability 0.2%
  • CVE-2025-12980 High 7.5 Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure 0.3%
  • CVE-2025-55707 High 7.2 WordPress PostX Plugin <= 4.1.35 - Privilege Escalation Vulnerability 0.4%
  • CVE-2025-54751 High 7.1 WordPress PostX plugin <= 4.1.36 - Broken Access Control vulnerability 0.3%
  • CVE-2025-62070 Medium 4.3 WordPress WowRevenue plugin <= 1.2.13 - Broken Access Control vulnerability 0.2%
  • CVE-2025-39571 Medium 4.3 WordPress WowStore plugin <= 4.2.4 - Broken Access Control Vulnerability 0.4%
  • CVE-2025-31096 Medium 6.5 WordPress PostX plugin <= 4.1.25 - Cross Site Scripting (XSS) Vulnerability 0.2%
  • CVE-2023-45271 Medium 4.3 WordPress ProductX – Gutenberg WooCommerce Blocks plugin <= 2.7.8 - Broken Access Control vulnerability 0.3%
  • CVE-2024-53818 Medium 6.5 WordPress PostX plugin <= 4.1.15 - Cross Site Scripting (XSS) vulnerability 0.4%
  • CVE-2024-50513 Medium 5.9 WordPress PostX plugin <= 4.1.15 - Cross Site Scripting (XSS) vulnerability 0.4%
  • CVE-2024-10728 High 8.8 PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation 39.1%
  • CVE-2024-50443 Medium 6.5 WordPress PostX plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability 0.3%