CVE-2026-92249Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter Exploitation status Not known exploited Fix Affected product Q Qi Addons For Elementor Published 09/18/2026 Severity Medium CVE-2026-10096Qi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter Exploitation status Not known exploited Fix Affected product Q Qi Blocks Published 07/01/2026 Severity Medium CVE-2025-67937WordPress Hendon theme < 1.7 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product H Hendon Published 01/08/2026 Severity High CVE-2025-67936WordPress Curly theme < 3.3 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product C Curly Published 01/08/2026 Severity High CVE-2025-67935WordPress Optimize theme < 2.4 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product O Optimize Published 01/08/2026 Severity High CVE-2025-67934WordPress Wellspring theme < 2.8 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product W Wellspring Published 01/08/2026 Severity High CVE-2025-69034WordPress Lekker theme <= 1.8 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product L Lekker Published 12/30/2025 Severity High CVE-2025-69032WordPress FiveStar theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability Exploitation status Not known exploited Fix Affected product F FiveStar Published 12/30/2025 Severity Medium CVE-2025-69030WordPress Backpack Traveler theme <= 2.10.3 - Insecure Direct Object References (IDOR) vulnerability Exploitation status Not known exploited Fix Affected product B Backpack Traveler Published 12/30/2025 Severity Medium CVE-2025-67515WordPress Wilmër theme < 3.5 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product W Wilmër Published 12/09/2025 Severity High CVE-2025-66532WordPress Powerlift theme < 3.2.1 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product P Powerlift Published 12/09/2025 Severity Medium CVE-2025-13157QODE Wishlist for WooCommerce <= 1.2.7 - Unauthenticated Insecure Direct Object Reference to Wishlist Update Exploitation status Not known exploited Fix Affected product Q QODE Wishlist for WooCommerce Published 11/27/2025 Severity Medium CVE-2025-12182Qi Blocks <= 1.4.3 - Missing Authorization to Arbitrary Attachment Resize Exploitation status Not known exploited Fix Affected product Q Qi Blocks Published 11/15/2025 Severity Medium CVE-2025-39467WordPress Wanderland theme <= 1.7.1 - Local File Inclusion Vulnerability Exploitation status Not known exploited Fix Affected product W Wanderland Published 11/06/2025 Severity High CVE-2025-39466WordPress Dør theme <= 2.4 - Local File Inclusion Vulnerability Exploitation status Not known exploited Fix Affected product D Dør Published 11/06/2025 Severity High CVE-2025-12180Qi Blocks <= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update Exploitation status Not known exploited Fix Affected product Q Qi Blocks Published 11/01/2025 Severity Medium CVE-2025-64368WordPress Bard theme <= 1.6 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product B Bard Published 10/31/2025 Severity Medium CVE-2025-8146Qi Addons for Elementor <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TypeOut Text Widget Exploitation status Not known exploited Fix Affected product Q Qi Addons For Elementor Published 08/02/2025 Severity Medium CVE-2025-6252Qi Addons For Elementor <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product Q Qi Addons For Elementor Published 06/28/2025 Severity Medium CVE-2025-49295WordPress MediClinic theme <= 2.1 - Local File Inclusion Vulnerability Exploitation status Not known exploited Fix Affected product M MediClinic Published 06/09/2025 Severity High CVE-2025-49296WordPress GrandPrix theme <= 1.6 - Local File Inclusion Vulnerability Exploitation status Not known exploited Fix Affected product G GrandPrix Published 06/09/2025 Severity High CVE-2025-49297WordPress Grill and Chow theme <= 1.6 - Local File Inclusion Vulnerability Exploitation status Not known exploited Fix Affected product G Grill and Chow Published 06/09/2025 Severity High CVE-2025-39490WordPress Backpack Traveler theme <= 2.10.2 - Local File Inclusion Vulnerability Exploitation status Not known exploited Fix Affected product B Backpack Traveler Published 05/23/2025 Severity High CVE-2025-39494WordPress Wilmër theme < 3.4.2 - Local File Inclusion Vulnerability Exploitation status Not known exploited Fix Affected product W Wilmër Published 05/23/2025 Severity High CVE-2025-39458WordPress Foton theme <= 2.5.2 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product F Foton Published 05/19/2025 Severity High CVE-2025-1627Qi Blocks < 1.4 - Contributor+ Stored XSS via ToC Block Exploitation status Public exploit Fix Affected product Q Qi Blocks Published 05/19/2025 Severity Medium CVE-2025-1626Qi Blocks < 1.4 - Contributor+ Stored XSS vi Countdown Block Exploitation status Public exploit Fix Affected product Q Qi Blocks Published 05/19/2025 Severity Medium CVE-2025-1625Qi Blocks < 1.4 - Contributor+ Stored XSS via Counter Block Exploitation status Public exploit Fix Affected product Q Qi Blocks Published 05/19/2025 Severity Medium CVE-2024-13699Qi Addons For Elementor <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product Q Qi Addons For Elementor Published 02/04/2025 Severity Medium CVE-2024-50457WordPress Qode Essential Addons plugin <= 1.6.3 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product Q Qode Essential Addons Published 10/28/2024 Severity High CVE-2024-49690WordPress Qi Blocks plugin <= 1.3.2 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product Q Qi Blocks Published 10/23/2024 Severity High CVE-2024-9530Qi Addons For Elementor <= 1.8.0 - Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product Q Qi Addons For Elementor Published 10/23/2024 Severity Medium CVE-2024-38712WordPress Qi Blocks plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product Q Qi Blocks Published 07/20/2024 Severity Medium CVE-2024-4887Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Local File Inclusion Exploitation status Not known exploited Fix Affected product Q Qi Addons For Elementor Published 06/07/2024 Severity High CVE-2024-5221Qi Blocks <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product Q Qi Blocks Published 06/06/2024 Severity Medium CVE-2024-4364Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Exploitation status Not known exploited Fix Affected product Q Qi Addons For Elementor Published 06/06/2024 Severity Medium CVE-2023-47679WordPress Qi Addons For Elementor plugin <= 1.6.3 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product Q Qi Addons For Elementor Published 05/17/2024 Severity Medium CVE-2024-3309Qi Addons For Elementor <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown widget Exploitation status Not known exploited Fix Affected product Q Qi Addons For Elementor Published 04/27/2024 Severity Medium CVE-2024-0826Qi Addons For Elementor <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product Q Qi Addons For Elementor Published 04/09/2024 Severity Medium CVE-2023-47840WordPress Qode Essential Addons Plugin <= 1.5.2 is vulnerable to Remote Code Execution (RCE) Exploitation status Not confirmed Fix Affected product Q Qode Essential Addons Published 12/29/2023 Severity Critical CVE-2023-47680WordPress Qi Addons For Elementor Plugin <= 1.6.3 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product Q Qi Addons For Elementor Published 11/13/2023 Severity Medium CVE-2023-40333WordPress Bridge Core Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product B Bridge Core Published 09/27/2023 Severity High CVE-2017-13138Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 08/23/2017 Severity Unknown 
