Log in Start free

wpWax

Products

ProductCVEsExploitedLatest
Directorist: AI-Powered Business Directory, Listings & Classified Ads10–Oct 14, 2026
Directorist5–Jul 13, 2026
Product Carousel Slider & Grid Ultimate for WooCommerce4–Jan 24, 2025
Legal Pages4–Nov 21, 2025
Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget3–Jan 24, 2025
FormGent2–Sep 30, 2026
Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid2–Aug 27, 2024
Post Grid, Slider & Carousel Ultimate2–Jan 27, 2025
Team (WordPress plugin)2–Jul 22, 2022
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More2–Aug 6, 2026
Templatiq1–Aug 18, 2026
Directorist – WordPress Business Directory Plugin with Classified Ads Listings1–Nov 7, 2023
Directorist AddonsKit for Elementor1–Apr 1, 2025
Directorist Booking1–Jun 16, 2026
HelpGent1–Apr 17, 2025
Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator1–Nov 22, 2023
Logo Carousel Slider1–Apr 16, 2025
Logo Showcase Ultimate1–Apr 9, 2025

Exploited and recent CVEs

  • CVE-2026-100185 Medium 6.4 Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field 0.2%
  • CVE-2026-17092 High 8.1 Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter 0.5%
  • CVE-2026-94499 High 7.1 WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability 0.3%
  • CVE-2026-32474 Critical 9.9 WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability 0.5%
  • CVE-2025-15028 High 7.2 FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting 0.3%
  • CVE-2026-3141 Critical 9.1 FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter 0.9%
  • CVE-2026-59518 Critical 9.8 WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability 0.6%
  • CVE-2026-49073 High 8.5 WordPress Directorist Booking plugin <= 3.0.3 - SQL Injection vulnerability 0.2%
  • CVE-2026-39509 Medium 5.3 WordPress Directorist plugin <= 8.5.10 - Broken Access Control vulnerability 0.2%
  • CVE-2026-22460 High 8.6 WordPress FormGent plugin <= 1.7.0 - Arbitrary File Deletion vulnerability 0.4%
  • CVE-2025-68069 High 7.1 WordPress Directorist plugin <= 8.6.6 - Broken Access Control vulnerability 0.3%
  • CVE-2025-64250 Medium 4.7 WordPress Directorist plugin <= 8.6.6 - Open Redirection vulnerability 0.2%
  • CVE-2025-66077 Medium 5.3 WordPress Legal Pages plugin <= 1.4.6 - Broken Access Control vulnerability 0.3%
  • CVE-2025-12174 Medium 6.5 Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update 0.2%
  • CVE-2025-10488 High 8.1 Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move 0.9%
  • CVE-2025-48242 Medium 6.5 WordPress Legal Pages plugin <= 1.4.5 - Broken Access Control Vulnerability 0.4%
  • CVE-2025-32658 Critical 9.8 WordPress HelpGent plugin <= 2.2.5 - PHP Object Injection vulnerability 0.5%
  • CVE-2025-39525 Medium 6.5 WordPress Logo Carousel Slider plugin <= 2.1.3 - Cross Site Scripting (XSS) Vulnerability 0.4%
  • CVE-2025-32499 Medium 6.5 WordPress Logo Showcase Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerability 0.8%
  • CVE-2025-31857 Medium 6.5 WordPress Directorist AddonsKit for Elementor plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2025-2224 Medium 5.3 Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing 0.4%
  • CVE-2025-1570 High 8.1 Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP 0.4%
  • CVE-2024-12041 Medium 5.3 Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings <= 8.0.12 - Unauthenticated User Information Exposure 0.4%
  • CVE-2025-24782 Medium 6.5 WordPress Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin <= 1.6.10 - Local File Inclusion vulnerability 0.5%
  • CVE-2025-24681 Medium 5.9 WordPress Product Carousel Slider & Grid Ultimate for WooCommerce Plugin <= 1.10.0 - Cross Site Scripting (XSS) vulnerability 0.4%
  • CVE-2024-13408 High 7.5 Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion 0.6%
  • CVE-2024-13409 High 7.5 Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion via post_type_ajax_handler() 0.9%
  • CVE-2024-12040 High 8.8 Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.10 - Authenticated (Contributor+) Local File Inclusion via 'theme' 0.8%
  • CVE-2024-44048 Medium 6.5 WordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin <= 1.9.10 - Authenticated Local File Inclusion vulnerability 0.5%
  • CVE-2024-8046 Medium 6.4 Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid <= 1.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload 0.3%