en
StellarWP is a WordPress software and tools provider within the Liquid Web family of brands. Its core business covers plugins and managed solutions for website building, events, learning management, fundraising, memberships, commerce, hosting, backups, and security. It operates as a global software provider serving varied WordPress users.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
As of 10/15/2026, stellarwp recorded 13 security vulnerabilities in the last 90 days across 7 products, including 5 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Kadence Blocks — Page Builder Toolkit for Gutenberg Editor had the most security vulnerabilities in the stellarwp ecosystem, with 3 vulnerabilities—approximately 23.08% of the provider's total vulnerabilities during this period.
CVE-2026-97643GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode AttributesCVE-2026-104762Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family AttributeCVE-2026-97634Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' ParameterCVE-2026-77820WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode AttributeCVE-2026-78159The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation147 Results | Page 1 of 15
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |
| SeverityCritical |
| SeverityCritical |
| SeverityHigh |
| SeverityMedium |
| SeverityHigh |
| SeverityMedium |