Roxnor vulnerabilities
94 CVEs and advisories name Roxnor as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-103898Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social…
- CVE-2026-104012Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking'…
- CVE-2026-100157WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)
- CVE-2026-103519WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter
- CVE-2026-97344Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write
- CVE-2026-94500WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-92235WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter
- CVE-2026-85575The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter
- CVE-2026-75971ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes
- CVE-2026-18100MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting
- CVE-2026-76063FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter
- CVE-2026-75930FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter
- CVE-2026-73993WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
- CVE-2026-32470WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
- CVE-2026-65440WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-59560WordPress FundEngine plugin <= 1.7.8 - Broken Access Control vulnerability
- CVE-2026-57406WordPress FundEngine plugin <= 1.7.6 - Broken Access Control vulnerability
- CVE-2026-57316WordPress GetGenie plugin <= 4.4.2 - Sensitive Data Exposure vulnerability
- CVE-2026-4362ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite
- CVE-2026-5957EmailKit <= 1.6.5 - Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter
- CVE-2026-39644WordPress Wp Ultimate Review plugin <= 2.3.8 - Broken Access Control vulnerability
- CVE-2026-2600ElementsKit Elementor Addons and Templates <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget
- CVE-2026-3474EmailKit <= 1.6.3 - Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter
- CVE-2026-2879GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion
- CVE-2026-2257GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API
- CVE-2026-23693ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint
- CVE-2026-1925EmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification
- CVE-2025-14895PopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion
- CVE-2025-13192Popup builder with Gamification <= 2.2.0 - Unauthenticated SQL Injection via Multiple REST API Endpoints
- CVE-2026-0633MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value