CVE-2026-18406SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload Exploitation status Not known exploited Fix Affected product S SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz Published 09/05/2026 Severity High CVE-2026-18402SureDash <= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute Exploitation status Not known exploited Fix Affected product S SureDash – Community, Courses & Member Dashboard Published 08/16/2026 Severity Medium CVE-2026-7623SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute Exploitation status Not known exploited Fix Affected product S SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz Published 08/01/2026 Severity Medium CVE-2026-15821SureDash <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Exploitation status Not known exploited Fix Affected product S SureDash – Community, Courses & Member Dashboard Published 07/24/2026 Severity Medium CVE-2026-15787Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Elementor Published 07/22/2026 Severity Medium CVE-2026-12900Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block Exploitation status Not known exploited Fix Affected product S Spectra Legacy – Gutenberg Blocks Published 07/20/2026 Severity Medium CVE-2026-15288SureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation Exploitation status Not known exploited Fix Affected product S SureForms – Drag & Drop Contact Form & Form Builder, Payment Form, Survey, Quiz & Calculator Published 07/10/2026 Severity High CVE-2026-7465Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes Exploitation status Not known exploited Fix Affected product S Spectra Gutenberg Blocks – Website Builder for the Block Editor Published 05/30/2026 Severity High CVE-2026-9065Surecart - SQL Injection Exploitation status Not known exploited Fix Affected product S Surecart Published 05/20/2026 Severity Critical CVE-2026-4987SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id' Exploitation status Not known exploited Fix Affected product S SureForms – Contact Form, Payment Form & Other Custom Form Builder Published 03/28/2026 Severity High CVE-2026-3534Astra <= 4.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Exploitation status Not known exploited Fix Affected product A Astra Published 03/11/2026 Severity Medium CVE-2026-0950Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data Exploitation status Not known exploited Fix Affected product S Spectra Gutenberg Blocks – Website Builder for the Block Editor Published 02/03/2026 Severity Medium CVE-2025-14351Custom Fonts – Host Your Fonts Locally <= 2.1.16 - Missing Authorization to Unauthenticated Font Deletion Exploitation status Not known exploited Fix Affected product C Custom Fonts – Host Your Fonts Locally Published 01/20/2026 Severity Medium CVE-2025-14855SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product S SureForms – Contact Form, Payment Form & Other Custom Form Builder Published 12/21/2025 Severity High CVE-2025-13065Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass Exploitation status Not known exploited Fix Affected product S Starter Templates – AI-Powered Templates for Elementor & Gutenberg Published 12/06/2025 Severity High CVE-2025-13516SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers <= 1.9.0 - Unauthenticated Arbitrary File Upload Exploitation status Not known exploited Fix Affected product S SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers Published 12/02/2025 Severity High CVE-2025-12535SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution Exploitation status Not known exploited Fix Affected product S SureForms – Contact Form, Payment Form & Other Custom Form Builder Published 11/19/2025 Severity Medium CVE-2025-12536SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product S SureForms – Contact Form, Payment Form & Other Custom Form Builder Published 11/13/2025 Severity Medium CVE-2025-11162Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS Exploitation status Not known exploited Fix Affected product S Spectra Gutenberg Blocks – Website Builder for the Block Editor Published 11/05/2025 Severity Medium CVE-2025-10732SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure Exploitation status Not known exploited Fix Affected product S SureForms – Contact Form, Payment Form & Other Custom Form Builder Published 10/14/2025 Severity Medium CVE-2025-10489SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation Exploitation status Not known exploited Fix Affected product S SureForms – Contact Form, Payment Form & Other Custom Form Builder Published 09/20/2025 Severity Medium CVE-2025-8488Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) <= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Elementor Published 08/02/2025 Severity Medium CVE-2025-5921SureForms < 1.7.2 - Reflected XSS Exploitation status Public exploit Fix Affected product S SureForms Published 08/01/2025 Severity Medium CVE-2025-6691SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion Exploitation status Not known exploited Fix Affected product S SureForms – Drag and Drop Form Builder for WordPress Published 07/09/2025 Severity High CVE-2025-6742SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion Exploitation status Not known exploited Fix Affected product S SureForms – Drag and Drop Form Builder for WordPress Published 07/09/2025 Severity High CVE-2025-3514SureForms < 1.4.4 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product S SureForms Published 05/02/2025 Severity Low CVE-2025-3513SureForms < 1.4.4 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product S SureForms Published 05/02/2025 Severity Low CVE-2025-3471SureForms < 1.4.4 - Contributor+ Settings Update Exploitation status Public exploit Fix Affected product S SureForms Published 04/30/2025 Severity Medium CVE-2025-3102SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation Exploitation status Not known exploited Fix Affected product O OttoKit: All-in-One Automation Platform Published 04/10/2025 Severity High CVE-2025-1784Spectra – WordPress Gutenberg Blocks <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product S Spectra Gutenberg Blocks – Website Builder for the Block Editor Published 03/26/2025 Severity Medium CVE-2024-12713SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure Exploitation status Not known exploited Fix Affected product S SureForms – Contact Form, Payment Form & Other Custom Form Builder Published 01/08/2025 Severity Medium CVE-2024-56274WordPress Astra Widgets plugin <= 1.2.15 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product A Astra Widgets Published 01/07/2025 Severity Medium CVE-2024-11230Elementor Header & Footer Builder <= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Elementor Published 12/23/2024 Severity Medium CVE-2023-23825WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Broken Access Control + CSRF on Import_WPforms vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 12/09/2024 Severity Low CVE-2023-23834WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Broken Access Control + CSRF on Activate_Plugin vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 12/09/2024 Severity Medium CVE-2024-10484Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget Exploitation status Not known exploited Fix Affected product S Spectra Gutenberg Blocks – Website Builder for the Block Editor Published 12/03/2024 Severity Medium CVE-2024-10325Elementor Header & Footer Builder <= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Elementor Published 11/08/2024 Severity Medium CVE-2024-37517WordPress Spectra plugin <= 2.13.7 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 11/01/2024 Severity Medium CVE-2024-50439WordPress Astra Widgets plugin <= 1.2.14 - Stored Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product A Astra Widgets Published 10/28/2024 Severity Medium CVE-2024-10050Elementor Header & Footer Builder <= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcode Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Elementor Published 10/24/2024 Severity Medium CVE-2024-43151WordPress Ultimate Addons for Beaver Builder – Lite plugin <= 1.5.9 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Beaver Builder – Lite Published 08/12/2024 Severity Medium CVE-2024-7590WordPress Spectra plugin<= 2.14.1 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 08/12/2024 Severity Medium CVE-2024-33933WordPress Elementor Header & Footer Builder plugin <= 1.6.35 - Contributor+ DOM-Based Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product E Elementor – Header, Footer & Blocks Template Published 07/22/2024 Severity Medium CVE-2024-37278WordPress Cards for Beaver Builder plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product C Cards for Beaver Builder Published 07/22/2024 Severity Medium CVE-2024-5251Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Published 07/17/2024 Severity Medium CVE-2024-5253Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Published 07/17/2024 Severity Medium CVE-2024-5252Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Published 07/17/2024 Severity Medium CVE-2024-5255Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Published 07/17/2024 Severity Medium CVE-2024-5254Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Published 07/17/2024 Severity Medium CVE-2024-37455WordPress Ultimate Addons for elementor plugin <= 1.36.31 - Privilege Escalation vulnerability Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Elementor Published 07/09/2024 Severity High CVE-2023-36676WordPress Spectra plugin <= 2.6.6 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 06/19/2024 Severity Medium CVE-2023-36684WordPress Convert Pro plugin <= 1.7.5 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product C Convert Pro Published 06/19/2024 Severity High CVE-2023-41805Broken Access Control vulnerability in multiple Brainstorm Force plugins Exploitation status Not known exploited Fix Affected product P Premium Starter Templates Published 06/19/2024 Severity Medium CVE-2023-44148WordPress Astra Bulk Edit plugin <= 1.2.7 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product A Astra Bulk Edit Published 06/19/2024 Severity Medium CVE-2023-44151WordPress Pre-Publish Checklist plugin <= 1.1.1 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product P Pre-Publish Checklist Published 06/19/2024 Severity Medium CVE-2024-4632WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product C CartFlows – Funnel Builder & Checkout Plugin for WooCommerce Published 06/19/2024 Severity Medium CVE-2023-51376WordPress ProjectHuddle Client Site plugin <= 1.0.34 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product P ProjectHuddle Client Site Published 06/14/2024 Severity Medium CVE-2024-5757Elementor Header & Footer Builder <= 1.6.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title Widget Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Elementor Published 06/13/2024 Severity Medium CVE-2024-5663Cards for Beaver Builder <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Cards Widget Exploitation status Not known exploited Fix Affected product C Cards for Beaver Builder Published 06/08/2024 Severity Medium CVE-2024-5485SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! <= 1.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link Shortcode Exploitation status Not known exploited Fix Affected product O OttoKit: All-in-One Automation Platform Published 06/04/2024 Severity Medium CVE-2023-23738WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Unauthenticated Email Spoofing Vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 06/03/2024 Severity Medium CVE-2023-23735WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Unauthenticated Email HTML Injection Vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 06/03/2024 Severity Medium CVE-2023-23730WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Captcha Bypass Vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 06/03/2024 Severity Medium CVE-2024-4366Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product S Spectra Gutenberg Blocks – Website Builder for the Block Editor Published 05/24/2024 Severity Medium CVE-2024-1332Custom Fonts – Host Your Fonts Locally <= 2.1.4 - Authenticated (Author+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product C Custom Fonts – Host Your Fonts Locally Published 05/24/2024 Severity Medium CVE-2024-2618Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Elementor Published 05/24/2024 Severity Medium CVE-2024-1814Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Block Exploitation status Not known exploited Fix Affected product S Spectra Gutenberg Blocks – Website Builder for the Block Editor Published 05/23/2024 Severity Medium CVE-2024-1815Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Block Exploitation status Not known exploited Fix Affected product S Spectra Gutenberg Blocks – Website Builder for the Block Editor Published 05/23/2024 Severity Medium CVE-2023-51401WordPress Ultimate Addons for Beaver Builder Premium plugin <= 1.35.13 - Limited Arbitrary File Download vulnerability Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Beaver Builder Published 05/17/2024 Severity Medium CVE-2023-51398WordPress Ultimate Addons for Beaver Builder Premium plugin <= 1.35.14 - Privilege Escalation vulnerability Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Beaver Builder Published 05/17/2024 Severity High CVE-2024-2619Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Author+) HTML Injection Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Elementor Published 05/16/2024 Severity Medium CVE-2024-4634Elementor Header & Footer Builder <= 1.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Elementor Published 05/16/2024 Severity Medium CVE-2024-4630Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product S Starter Templates – AI-Powered Templates for Elementor & Gutenberg Published 05/11/2024 Severity Medium CVE-2024-1467Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.1.6 - Authenticated (Contributor+) Server-Side Request Forgery Exploitation status Not known exploited Fix Affected product S Starter Templates – AI-Powered Templates for Elementor & Gutenberg Published 05/09/2024 Severity Medium CVE-2024-3107Spectra – WordPress Gutenberg Blocks <= 2.12.6 - Authenticated (Contributor+) Path Traversal Exploitation status Not known exploited Fix Affected product S Spectra Gutenberg Blocks – Website Builder for the Block Editor Published 05/02/2024 Severity Medium CVE-2024-2347Astra <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name Exploitation status Not known exploited Fix Affected product A Astra Published 04/09/2024 Severity Medium CVE-2023-6486Spectra – WordPress Gutenberg Blocks <= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSS Exploitation status Not known exploited Fix Affected product S Spectra Gutenberg Blocks – Website Builder for the Block Editor Published 04/09/2024 Severity Medium CVE-2024-2305Cards for Beaver Builder <= 1.1.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via bootstrapcard link Exploitation status Not known exploited Fix Affected product C Cards for Beaver Builder Published 04/09/2024 Severity Medium CVE-2024-2140Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Icons Widget Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Beaver Builder – Lite Published 03/30/2024 Severity Medium CVE-2024-2142Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Table Widget Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Beaver Builder – Lite Published 03/30/2024 Severity Medium CVE-2024-2141Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Beaver Builder – Lite Published 03/30/2024 Severity Medium CVE-2024-2144Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Separator Widget Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Beaver Builder – Lite Published 03/30/2024 Severity Medium CVE-2024-2143Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Beaver Builder – Lite Published 03/30/2024 Severity Medium CVE-2023-36679WordPress Spectra plugin <= 2.6.6 - Server Side Request Forgery (SSRF) vulnerability Exploitation status Not known exploited Fix Affected product S Spectra Published 03/28/2024 Severity High CVE-2024-1564Schema Pro < 2.7.16 - Contributor+ Custom Field Access Exploitation status Public exploit Fix Affected product W wp-schema-pro Published 03/25/2024 Severity Medium CVE-2024-1237Elementor Header & Footer Builder <= 1.6.24 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Elementor Published 03/13/2024 Severity Medium CVE-2023-23882WordPress Ultimate Addons for Beaver Builder – Lite Plugin <= 1.5.5 is vulnerable to Broken Access Control Exploitation status Not known exploited Fix Affected product U Ultimate Addons for Beaver Builder – Lite Published 01/17/2024 Severity Medium CVE-2023-51402WordPress Ultimate Addons for WPBakery Page Builder Plugin <= 3.19.17 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Page Builder Published 12/29/2023 Severity Medium CVE-2023-51397WordPress WP Remote Site Search Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not confirmed Fix Affected product W WP Remote Site Search Published 12/29/2023 Severity Medium CVE-2023-49830WordPress Astra Pro Plugin <= 4.3.1 is vulnerable to Remote Code Execution (RCE) Exploitation status Not confirmed Fix Affected product A Astra Pro Published 12/29/2023 Severity Critical CVE-2023-49833WordPress Spectra Plugin <= 2.7.9 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product S Spectra – WordPress Gutenberg Blocks Published 12/14/2023 Severity Medium CVE-2023-41804WordPress Starter Templates Plugin <= 3.2.4 is vulnerable to Server Side Request Forgery (SSRF) Exploitation status Not confirmed Fix Affected product S Starter Templates — Elementor, WordPress & Beaver Builder Templates Published 12/07/2023 Severity High CVE-2023-36682WordPress Schema Pro Plugin <= 2.7.7 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not confirmed Fix Affected product S Schema Pro Published 11/30/2023 Severity High CVE-2023-36685WordPress CartFlows Pro Plugin <= 1.11.12 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not confirmed Fix Affected product C CartFlows Pro Published 11/30/2023 Severity Medium CVE-2023-46211WordPress Ultimate Addons for WPBakery Page Builder Plugin <= 3.19.14 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product U Ultimate Addons for WPBakery Page Builder Published 10/27/2023 Severity Medium CVE-2020-36747Lightweight Sidebar Manager <= 1.1.4 - Cross-Site Request Forgery Bypass Exploitation status Not known exploited Fix Affected product L Lightweight Sidebar Manager Published 07/01/2023 Severity Medium CVE-2020-36737Import / Export Customizer Settings <= 1.0.3 - Cross-Site Request Forgery Bypass Exploitation status Not known exploited Fix Affected product I Import / Export Customizer Settings Published 07/01/2023 Severity Medium CVE-2020-36736WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 1.5.15 - Cross-Site Request Forgery Bypass Exploitation status Not known exploited Fix Affected product C CartFlows – Funnel Builder & Checkout Plugin for WooCommerce Published 07/01/2023 Severity Medium CVE-2019-25151Funnel Builder <= 1.3.0 - Arbitrary Plugin Activation Exploitation status Not known exploited Fix Affected product C CartFlows – Funnel Builder & Checkout Plugin for WooCommerce Published 06/07/2023 Severity Medium CVE-2020-36702Spectra – WordPress Gutenberg Blocks <= 1.14.7 - Missing Authorization Exploitation status Not known exploited Fix Affected product S Spectra Gutenberg Blocks – Website Builder for the Block Editor Published 06/07/2023 Severity Medium 
