CVE-2026-62134WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability Exploitation status Not known exploited Fix Affected product S Starter Templates Published 09/11/2026 Severity Medium CVE-2026-85308WordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability Exploitation status Not known exploited Fix Affected product S SureForms Published 09/03/2026 Severity Medium CVE-2026-80433WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability Exploitation status Not known exploited Fix Affected product S SureFeedback Client Site Published 08/27/2026 Severity High CVE-2026-32553WordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerability Exploitation status Not known exploited Fix Affected product O OttoKit Published 08/18/2026 Severity High CVE-2026-66698WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product S SureDash Published 08/13/2026 Severity High CVE-2026-66688WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Elementor Published 08/06/2026 Severity Medium CVE-2026-57401WordPress SureDash plugin <= 1.8.0 - Arbitrary File Deletion vulnerability Exploitation status Not known exploited Fix Affected product S SureDash Published 07/13/2026 Severity Critical CVE-2026-54813WordPress SureDash plugin <= 1.8.0 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product S SureDash Published 06/17/2026 Severity High CVE-2026-49781WordPress OttoKit plugin <= 1.1.27 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product O OttoKit Published 06/15/2026 Severity Critical CVE-2026-39470WordPress WooCommerce Cart Abandonment Recovery plugin < 2.1.0 - Privilege Escalation vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Cart Abandonment Recovery Published 06/15/2026 Severity High CVE-2026-45442WordPress Presto Player plugin <= 4.1.3 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product P Presto Player Published 05/19/2026 Severity Medium CVE-2026-42648WordPress Spectra plugin <= 2.19.22 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 04/29/2026 Severity Medium CVE-2026-42377WordPress SureForms Pro plugin <= 2.8.0 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product S SureForms Pro Published 04/29/2026 Severity High CVE-2026-39479WordPress OttoKit plugin <= 1.1.20 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product O OttoKit Published 04/08/2026 Severity High CVE-2026-39477WordPress CartFlows plugin <= 2.2.3 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product C CartFlows Published 04/08/2026 Severity Medium CVE-2026-34889WordPress Ultimate Addons for WPBakery Page Builder plugin < 3.21.4 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Page Builder Published 04/01/2026 Severity Medium CVE-2026-32431WordPress Astra Bulk Edit plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product A Astra Bulk Edit Published 03/13/2026 Severity Medium CVE-2026-28038WordPress Ultimate Addons for WPBakery Page Builder plugin <= 3.21.1 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Page Builder Published 03/05/2026 Severity Medium CVE-2026-25316WordPress CartFlows plugin <= 2.1.19 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product C CartFlows Published 02/19/2026 Severity High CVE-2026-24982WordPress Spectra plugin <= 2.19.17 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 02/03/2026 Severity Medium CVE-2026-24962WordPress Sigmize plugin <= 0.0.9 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product S Sigmize Published 02/03/2026 Severity Medium CVE-2025-68497WordPress Astra Widgets plugin <= 1.2.16 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product A Astra Widgets Published 12/24/2025 Severity Medium CVE-2023-23729WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Contributor+ reCAPTCHA Settings Change Vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 12/09/2025 Severity Medium CVE-2025-62059WordPress SureRank plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product S SureRank Published 11/06/2025 Severity High CVE-2025-48088WordPress Ultimate Addons for WPBakery Page Builder plugin < 3.21.1 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Page Builder Published 10/27/2025 Severity Medium CVE-2025-11814Ultimate Addons for WPBakery Page Builder < 3.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Published 10/16/2025 Severity Medium CVE-2025-48164WordPress SureDash <= 1.0.3 - Privilege Escalation Vulnerability Exploitation status Not known exploited Fix Affected product S SureDash Published 08/20/2025 Severity High CVE-2025-54685WordPress SureDash Plugin <= 1.1.0 - Sensitive Data Exposure Vulnerability Exploitation status Not known exploited Fix Affected product S SureDash Published 08/14/2025 Severity Medium CVE-2025-27007WordPress SureTriggers <= 1.0.82 - Privilege Escalation Vulnerability Exploitation status Not known exploited Fix Affected product O OttoKit Published 05/01/2025 Severity Critical CVE-2024-12434SureMembers <= 1.10.6 - Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product S SureMembers Published 02/26/2025 Severity Medium CVE-2024-13800Popup Plugin For WordPress - ConvertPlus <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update Exploitation status Not known exploited Fix Affected product C ConvertPlus Published 02/12/2025 Severity High CVE-2025-24568WordPress Starter Templates plugin <= 4.4.9 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product S Starter Templates Published 01/24/2025 Severity Medium CVE-2024-56274WordPress Astra Widgets plugin <= 1.2.15 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product A Astra Widgets Published 01/07/2025 Severity Medium CVE-2023-23825WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Broken Access Control + CSRF on Import_WPforms vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 12/09/2024 Severity Low CVE-2023-23834WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Broken Access Control + CSRF on Activate_Plugin vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 12/09/2024 Severity Medium CVE-2024-37517WordPress Spectra plugin <= 2.13.7 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 11/01/2024 Severity Medium CVE-2024-50439WordPress Astra Widgets plugin <= 1.2.14 - Stored Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product A Astra Widgets Published 10/28/2024 Severity Medium CVE-2024-47345WordPress Starter Templates plugin <= 4.4.0 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product S Starter Templates Published 10/06/2024 Severity Medium CVE-2024-43151WordPress Ultimate Addons for Beaver Builder – Lite plugin <= 1.5.9 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Beaver Builder – Lite Published 08/12/2024 Severity Medium CVE-2024-7590WordPress Spectra plugin<= 2.14.1 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 08/12/2024 Severity Medium CVE-2024-3827Spectra Pro <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block IDs Exploitation status Not known exploited Fix Affected product S Spectra Pro Published 08/02/2024 Severity Medium CVE-2024-5251Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Published 07/17/2024 Severity Medium CVE-2024-5253Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Published 07/17/2024 Severity Medium CVE-2024-5252Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Published 07/17/2024 Severity Medium CVE-2024-5255Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Published 07/17/2024 Severity Medium CVE-2024-5254Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Published 07/17/2024 Severity Medium CVE-2024-37455WordPress Ultimate Addons for elementor plugin <= 1.36.31 - Privilege Escalation vulnerability Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Elementor Published 07/09/2024 Severity High CVE-2023-36676WordPress Spectra plugin <= 2.6.6 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 06/19/2024 Severity Medium CVE-2023-36684WordPress Convert Pro plugin <= 1.7.5 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product C Convert Pro Published 06/19/2024 Severity High CVE-2023-41805Broken Access Control vulnerability in multiple Brainstorm Force plugins Exploitation status Not known exploited Fix Affected product P Premium Starter Templates Published 06/19/2024 Severity Medium CVE-2023-44148WordPress Astra Bulk Edit plugin <= 1.2.7 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product A Astra Bulk Edit Published 06/19/2024 Severity Medium CVE-2023-44151WordPress Pre-Publish Checklist plugin <= 1.1.1 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product P Pre-Publish Checklist Published 06/19/2024 Severity Medium CVE-2023-51376WordPress ProjectHuddle Client Site plugin <= 1.0.34 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product P ProjectHuddle Client Site Published 06/14/2024 Severity Medium CVE-2023-23738WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Unauthenticated Email Spoofing Vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 06/03/2024 Severity Medium CVE-2023-23735WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Unauthenticated Email HTML Injection Vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 06/03/2024 Severity Medium CVE-2023-23730WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Captcha Bypass Vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 06/03/2024 Severity Medium CVE-2023-51401WordPress Ultimate Addons for Beaver Builder Premium plugin <= 1.35.13 - Limited Arbitrary File Download vulnerability Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Beaver Builder Published 05/17/2024 Severity Medium CVE-2023-51398WordPress Ultimate Addons for Beaver Builder Premium plugin <= 1.35.14 - Privilege Escalation vulnerability Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Beaver Builder Published 05/17/2024 Severity High CVE-2023-50890WordPress Ultimate Addons for Elementor plugin <= 1.36.20 - Privilege Escalation vulnerability Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Elementor Published 05/17/2024 Severity High CVE-2023-46205WordPress Ultimate Addons for WPBakery Page Builder plugin <= 3.19.14 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Page Builder Published 05/17/2024 Severity High CVE-2024-4838ConvertPlus <= 3.5.26 - Authenticated (Contributor+) PHP Object Injection Exploitation status Not known exploited Fix Affected product C ConvertPlus Published 05/16/2024 Severity High CVE-2024-3828Spectra Pro <= 1.1.5 - Authenticated (Author+) Privilege Escalation Exploitation status Not known exploited Fix Affected product S Spectra Pro Published 05/10/2024 Severity High CVE-2024-3240ConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object Injection Exploitation status Not known exploited Fix Affected product C ConvertPlus Published 05/04/2024 Severity High CVE-2024-3237ConvertPlug <= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update Exploitation status Not known exploited Fix Affected product C ConvertPlus Published 05/04/2024 Severity Medium CVE-2023-34370Server Side Request Forgery (SSRF) vulnerability in Starter Templates plugins Exploitation status Not known exploited Fix Affected product S Starter Templates — Elementor, WordPress & Beaver Builder Templates Published 03/28/2024 Severity High CVE-2023-36679WordPress Spectra plugin <= 2.6.6 - Server Side Request Forgery (SSRF) vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 03/28/2024 Severity High CVE-2024-29768WordPress Astra theme <= 4.6.4 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product A Astra Published 03/27/2024 Severity Medium CVE-2023-23882WordPress Ultimate Addons for Beaver Builder – Lite Plugin <= 1.5.5 is vulnerable to Broken Access Control Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Beaver Builder – Lite Published 01/17/2024 Severity Medium CVE-2023-51397WordPress WP Remote Site Search Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not confirmed Fix Affected product W WP Remote Site Search Published 12/29/2023 Severity Medium CVE-2023-49830WordPress Astra Pro Plugin <= 4.3.1 is vulnerable to Remote Code Execution (RCE) Exploitation status Not confirmed Fix Affected product A Astra Pro Published 12/29/2023 Severity Critical CVE-2023-49833WordPress Spectra Plugin <= 2.7.9 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product S Spectra – WordPress Gutenberg Blocks Published 12/14/2023 Severity Medium CVE-2023-41804WordPress Starter Templates Plugin <= 3.2.4 is vulnerable to Server Side Request Forgery (SSRF) Exploitation status Not confirmed Fix Affected product S Starter Templates — Elementor, WordPress & Beaver Builder Templates Published 12/07/2023 Severity High CVE-2023-46211WordPress Ultimate Addons for WPBakery Page Builder Plugin <= 3.19.14 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Page Builder Published 10/27/2023 Severity Medium CVE-2023-25058WordPress Schema – All In One Schema Rich Snippets Plugin <= 1.6.5 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product S Schema – All In One Schema Rich Snippets Published 05/26/2023 Severity Medium CVE-2022-46851WordPress Starter Templates Plugin <= 3.1.20 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product S Starter Templates Published 05/23/2023 Severity Medium 
