# cve.now: Pickplugins

The newest entries naming Pickplugins as an affected vendor (up to 200), of 76 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-116392](https://cve.now/CVE-2026-116392.md): WordPress Accordion plugin \<= 2.3.25 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2024-11080](https://cve.now/CVE-2024-11080.md): Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection (CVSS 9.8)
- [CVE-2026-10207](https://cve.now/CVE-2026-10207.md): PickPlugins Question Answer \<= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter (CVSS 7.5)
- [CVE-2026-65456](https://cve.now/CVE-2026-65456.md): WordPress Product Slider for WooCommerce plugin \<= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3)
- [CVE-2026-10862](https://cve.now/CVE-2026-10862.md): Accordions \<= 2.3.23 - Authenticated (Custom+) Stored Cross-Site Scripting via Accordion Body Field (CVSS 6.4)
- [CVE-2025-62745](https://cve.now/CVE-2025-62745.md): WordPress Team Showcase plugin \<= 1.22.28 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-7458](https://cve.now/CVE-2026-7458.md): User Verification by PickPlugins \<= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint (CVSS 9.8)
- [CVE-2026-32497](https://cve.now/CVE-2026-32497.md): WordPress User Verification plugin \<= 2.0.45 - Email Verification Bypass vulnerability (CVSS 5.3)
- [CVE-2026-25455](https://cve.now/CVE-2026-25455.md): WordPress Product Slider for WooCommerce plugin \<= 1.13.61 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-68000](https://cve.now/CVE-2025-68000.md): WordPress Testimonial Slider plugin \<= 2.0.15 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-68605](https://cve.now/CVE-2025-68605.md): WordPress Post Grid and Gutenberg Blocks plugin \<= 2.3.23 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-63043](https://cve.now/CVE-2025-63043.md): WordPress Post Grid and Gutenberg Blocks plugin \<= 2.3.23 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
- [CVE-2025-66058](https://cve.now/CVE-2025-66058.md): WordPress Post Grid and Gutenberg Blocks plugin \<= 2.3.17 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-12374](https://cve.now/CVE-2025-12374.md): Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification \<= 2.0.44 - Authentication Bypass to Account Takeover (CVSS 9.8)
- [CVE-2025-62929](https://cve.now/CVE-2025-62929.md): WordPress Testimonial Slider plugin \<= 2.0.15 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-62924](https://cve.now/CVE-2025-62924.md): WordPress Post Grid and Gutenberg Blocks plugin \<= 2.3.17 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-53421](https://cve.now/CVE-2025-53421.md): WordPress Accordion plugin \<= 2.3.14 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-60162](https://cve.now/CVE-2025-60162.md): WordPress Job Board Manager Plugin \<= 2.1.61 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-58678](https://cve.now/CVE-2025-58678.md): WordPress Accordion Plugin \<= 2.3.15 - Broken Access Control Vulnerability (CVSS 6.5)
- [CVE-2025-58827](https://cve.now/CVE-2025-58827.md): WordPress Job Board Manager Plugin \<= 2.1.61 - Content Injection Vulnerability (CVSS 3.8)
- [CVE-2025-54007](https://cve.now/CVE-2025-54007.md): WordPress Post Grid and Gutenberg Blocks Plugin \<= 2.3.11 - PHP Object Injection Vulnerability (CVSS 8.8)
- [CVE-2025-49324](https://cve.now/CVE-2025-49324.md): WordPress Job Board Manager plugin \<= 2.1.60 - Broken Access Control Vulnerability (CVSS 5.3)
- [CVE-2025-49075](https://cve.now/CVE-2025-49075.md): WordPress Wishlist plugin \<= 1.0.43 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-24655](https://cve.now/CVE-2025-24655.md): WordPress Wishlist Plugin \<= 1.0.39 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-32646](https://cve.now/CVE-2025-32646.md): WordPress Question Answer plugin \<= 1.2.70 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-32647](https://cve.now/CVE-2025-32647.md): WordPress Question Answer plugin \<= 1.2.73 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2025-32618](https://cve.now/CVE-2025-32618.md): WordPress Wishlist plugin \<= 1.0.46 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-32144](https://cve.now/CVE-2025-32144.md): WordPress Job Board Manager Plugin \<= 2.1.61 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2025-32143](https://cve.now/CVE-2025-32143.md): WordPress Accordion plugin \<= 2.3.11 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2025-32272](https://cve.now/CVE-2025-32272.md): WordPress Wishlist plugin \<= 1.0.46 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-30889](https://cve.now/CVE-2025-30889.md): WordPress Testimonial Slider plugin \<= 2.0.13 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2025-31862](https://cve.now/CVE-2025-31862.md): WordPress Job Board Manager Plugin \<= 2.1.61 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-31810](https://cve.now/CVE-2025-31810.md): WordPress Question Answer plugin \<= 1.2.73 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-12634](https://cve.now/CVE-2024-12634.md): Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins \<= 2.0.59 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-12809](https://cve.now/CVE-2024-12809.md): Wishlist \<= 1.0.43 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-13469](https://cve.now/CVE-2024-13469.md): Pricing Table by PickPlugins \<= 1.12.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-13796](https://cve.now/CVE-2024-13796.md): Post Grid and Gutenberg Blocks – ComboBlocks \<= 2.3.6 - Unauthenticated User Information Exposure (CVSS 5.3)
- [CVE-2025-26915](https://cve.now/CVE-2025-26915.md): WordPress Wishlist Plugin \<= 1.0.41 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2024-13798](https://cve.now/CVE-2024-13798.md): Post Grid and Gutenberg Blocks – ComboBlocks \<= 2.3.5 - Unauthenticated Paid Order Creation (CVSS 5.3)
- [CVE-2025-22679](https://cve.now/CVE-2025-22679.md): WordPress Job Board Manager Plugin \<= 2.1.61 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-24622](https://cve.now/CVE-2025-24622.md): WordPress Job Board Manager plugin \<= 2.1.59 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2024-9636](https://cve.now/CVE-2024-9636.md): Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation (CVSS 9.8)
- [CVE-2024-55993](https://cve.now/CVE-2024-55993.md): WordPress Job Board Manager plugin \<= 2.1.61 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-54273](https://cve.now/CVE-2024-54273.md): WordPress Mail Picker plugin \<= 1.0.14 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2024-10937](https://cve.now/CVE-2024-10937.md): Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins \<= 2.0.58 - Sensitive Information Exposure (CVSS 5.3)
- [CVE-2024-53772](https://cve.now/CVE-2024-53772.md): WordPress Mail Picker plugin \<= 1.0.15 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-9111](https://cve.now/CVE-2024-9111.md): Product Designer \<= 1.0.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4)
- [CVE-2024-38726](https://cve.now/CVE-2024-38726.md): WordPress Product Designer plugin \<= 1.0.33 - Arbitrary Content Deletion vulnerability (CVSS 7.5)
- [CVE-2024-50432](https://cve.now/CVE-2024-50432.md): WordPress Post Grid and Gutenberg Blocks plugin \<= 2.2.93 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2021-4450](https://cve.now/CVE-2021-4450.md): Post Grid \<= 2.1.12 - Contributor+ SQL Injection (CVSS 8.8)
- [CVE-2024-47340](https://cve.now/CVE-2024-47340.md): WordPress ComboBlocks plugin \<= 2.2.89 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-47342](https://cve.now/CVE-2024-47342.md): WordPress Accordion plugin \<= 2.2.99 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-44002](https://cve.now/CVE-2024-44002.md): WordPress Team Showcase plugin \<= 1.22.25 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-45459](https://cve.now/CVE-2024-45459.md): WordPress Product Slider for WooCommerce by PickPlugins plugin \<= 1.13.50 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-8253](https://cve.now/CVE-2024-8253.md): Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8)
- [CVE-2024-43321](https://cve.now/CVE-2024-43321.md): WordPress Team Showcase plugin \<= 1.22.23 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-7588](https://cve.now/CVE-2024-7588.md): Gutenberg Blocks, Page Builder – ComboBlocks \<= 2.2.87 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Block (CVSS 6.4)
- [CVE-2024-43155](https://cve.now/CVE-2024-43155.md): WordPress ComboBlocks plugin \<= 2.2.86 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-6346](https://cve.now/CVE-2024-6346.md): Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks \<= 2.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via redirectURL Parameter of Date Countdown Widget (CVSS 6.4)
- [CVE-2024-38722](https://cve.now/CVE-2024-38722.md): WordPress Job Board Manager plugin \<= 2.1.57 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-3608](https://cve.now/CVE-2024-3608.md): Product Designer \<= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion (CVSS 5.3)
- [CVE-2024-4042](https://cve.now/CVE-2024-4042.md): Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel - Combo Blocks \<= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attribute (CVSS 6.4)
- [CVE-2024-1988](https://cve.now/CVE-2024-1988.md): Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks \<= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2023-40557](https://cve.now/CVE-2023-40557.md): WordPress Tabs & Accordion plugin \<= 1.3.10 - Content Injection vulnerability (CVSS 5.4)
- [CVE-2024-3155](https://cve.now/CVE-2024-3155.md): Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks \<= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-32816](https://cve.now/CVE-2024-32816.md): WordPress Combo Blocks plugin \<= 2.2.78 - Sensitive Data Exposure via API vulnerability (CVSS 7.5)
- [CVE-2024-1641](https://cve.now/CVE-2024-1641.md): Accordion \<= 2.2.96 - Missing Authorization to Authenticated(Contributor+) Post Duplication (CVSS 5.4)
- [CVE-2024-31277](https://cve.now/CVE-2024-31277.md): WordPress Product Designer plugin \<= 1.0.32 - PHP Object Injection vulnerability (CVSS 8.7)
- [CVE-2024-30441](https://cve.now/CVE-2024-30441.md): WordPress Combo Blocks plugin \<= 2.2.74 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-29097](https://cve.now/CVE-2024-29097.md): WordPress User profile plugin \<= 2.0.20 - Subscriber+ Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.3)
- [CVE-2023-7072](https://cve.now/CVE-2023-7072.md): Post Grid Combo – 36+ Gutenberg Blocks \<= 2.2.68 - Information Exposure via get\_posts API Endpoint (CVSS 7.5)
- [CVE-2023-51666](https://cve.now/CVE-2023-51666.md): WordPress Related Post Plugin \<= 2.0.53 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-6645](https://cve.now/CVE-2023-6645.md): Post Grid Combo – 36+ Gutenberg Blocks \<= 2.2.64 - Authenticated (Contributor+) Cross-Site Scripting (CVSS 6.4)
- [CVE-2023-40211](https://cve.now/CVE-2023-40211.md): WordPress Post Grid Plugin \<= 2.2.50 is vulnerable to Sensitive Data Exposure (CVSS 7.5)
- [CVE-2021-24300](https://cve.now/CVE-2021-24300.md): PickPlugins Product Slider for WooCommerce \< 1.13.22 - Reflected Cross-Site Scripting (XSS) (no CVSS)
- [CVE-2021-24283](https://cve.now/CVE-2021-24283.md): Accordion \< 2.2.30 - Authenticated Reflected Cross-Site Scripting (XSS) (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/pickplugins
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.