WpOpal
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Opal Estate | 2 | – | Jul 1, 2023 |
| Opal Membership | 2 | – | Aug 10, 2024 |
| Opal Woo Custom Product Variation | 2 | – | May 23, 2025 |
| Opal Estate Pro – Property Management and Submission | 2 | – | Jul 1, 2025 |
| Opal Portfolio | 1 | – | Apr 1, 2025 |
| Opal Service | 1 | – | Oct 27, 2025 |
| Opal Widgets For Elementor | 1 | – | Apr 29, 2024 |
| GG Bought Together for WooCommerce | 1 | – | Jun 27, 2025 |
| Wpopal Core Features | 1 | – | Jan 19, 2024 |
| GG Woo Feed for WooCommerce Shopping Feed on Google and Other Channels | 1 | – | Jan 11, 2024 |
| GutenGeek Free Gutenberg Blocks for WordPress | 1 | – | Sep 25, 2024 |
| Opal Hotel Room Booking (WordPress plugin) | 1 | – | May 19, 2022 |
Exploited and recent CVEs
- CVE-2025-62913 WordPress Opal Service plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability 0.2%
- CVE-2025-6934 Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user' 25.4%
- CVE-2025-23967 WordPress GG Bought Together for WooCommerce plugin <= 1.0.2 - SQL Injection Vulnerability 0.4%
- CVE-2025-47535 WordPress Opal Woo Custom Product Variation plugin <= 1.2.0 - Arbitrary File Deletion Vulnerability 0.5%
- CVE-2025-31748 WordPress Opal Portfolio Plugin <= 1.0.4 - Stored Cross Site Scripting (XSS) vulnerability 0.4%
- CVE-2024-52444 WordPress Opal Woo Custom Product Variation plugin <= 1.1.3 - Arbitrary File Deletion vulnerability 0.6%
- CVE-2024-9073 GutenGeek Free Gutenberg Blocks for WordPress <= 1.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload 0.3%
- CVE-2024-7649 Opal Membership <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting 0.5%
- CVE-2024-7648 Opal Membership <= 1.2.4 - Authenticated (Subscriber+) Information Disclosure 0.6%
- CVE-2024-3666 Opal Estate Pro – Property Management and Submission <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
- CVE-2024-33649 WordPress Opal Widgets For Elementor plugin <= 1.6.9 - Cross Site Scripting (XSS) vulnerability 0.3%
- CVE-2022-40700 Server Side Request Forgery (SSRF) vulnerability affecting multiple WordPress plugins 1.0%
- CVE-2023-6638 GTG Product Feed for Shopping <= 1.2.4 - Missing Authorization to Unauthenticated Plugin Settings Update 0.5%
- CVE-2021-4388 Opal Estate <= 1.6.11 - Missing Authorization 0.7%
- CVE-2021-4387 Opal Estate <= 1.6.11 - Cross-Site Request Forgery Bypass 0.6%
- CVE-2022-29449 WordPress Opal Hotel Room Booking plugin <= 1.2.7 - Stored Cross-Site Scripting (XSS) vulnerability 0.5%