# cve.now: Roxnor

The newest entries naming Roxnor as an affected vendor (up to 200), of 94 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-103898](https://cve.now/CVE-2026-103898.md): Wp Social Login and Register Social Counter \<= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social… (CVSS 8.1)
- [CVE-2026-104012](https://cve.now/CVE-2026-104012.md): Rox Appointment Booking \<= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking'… (CVSS 8.8)
- [CVE-2026-100157](https://cve.now/CVE-2026-100157.md): WP Ultimate Review \<= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs\_reviw\_summery' Parameter (Split-Shortcode / Late-Registered Shortcode) (CVSS 6.5)
- [CVE-2026-103519](https://cve.now/CVE-2026-103519.md): WP Ultimate Review \<= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs\_reviw\_summery' Parameter (CVSS 5.4)
- [CVE-2026-97344](https://cve.now/CVE-2026-97344.md): Wp Social Login and Register Social Counter \<= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write (CVSS 6.4)
- [CVE-2026-94500](https://cve.now/CVE-2026-94500.md): WordPress ElementsKit Elementor addons Lite plugin \<= 4.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-92235](https://cve.now/CVE-2026-92235.md): WP Ultimate Review \<= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs\_submit\_review\_data\[xs\_reviw\_summery\]' Parameter (CVSS 8.1)
- [CVE-2026-85575](https://cve.now/CVE-2026-85575.md): The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets \<= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine\_product\_title\_header\_size' Parameter (CVSS 6.4)
- [CVE-2026-75971](https://cve.now/CVE-2026-75971.md): ShopEngine Elementor WooCommerce Builder Addon \<= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '\<wp\_option\>' Nodes (CVSS 7.2)
- [CVE-2026-18100](https://cve.now/CVE-2026-18100.md): MetForm \<= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf\_form\_id' Widget Setting (CVSS 6.4)
- [CVE-2026-76063](https://cve.now/CVE-2026-76063.md): FundEngine \<= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp\_featured\_video\_url' Parameter (CVSS 6.4)
- [CVE-2026-75930](https://cve.now/CVE-2026-75930.md): FundEngine \<= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign\_post' Parameter (CVSS 4.3)
- [CVE-2026-73993](https://cve.now/CVE-2026-73993.md): WordPress FundEngine plugin \<= 1.7.9 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-32470](https://cve.now/CVE-2026-32470.md): WordPress FundEngine plugin \<= 1.7.9 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-65440](https://cve.now/CVE-2026-65440.md): WordPress GetGenie plugin \<= 4.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-59560](https://cve.now/CVE-2026-59560.md): WordPress FundEngine plugin \<= 1.7.8 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-57406](https://cve.now/CVE-2026-57406.md): WordPress FundEngine plugin \<= 1.7.6 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-57316](https://cve.now/CVE-2026-57316.md): WordPress GetGenie plugin \<= 4.4.2 - Sensitive Data Exposure vulnerability (CVSS 6.5)
- [CVE-2026-4362](https://cve.now/CVE-2026-4362.md): ElementsKit Elementor Addons \<= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite (CVSS 6.5)
- [CVE-2026-5957](https://cve.now/CVE-2026-5957.md): EmailKit \<= 1.6.5 - Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter (CVSS 6.5)
- [CVE-2026-39644](https://cve.now/CVE-2026-39644.md): WordPress Wp Ultimate Review plugin \<= 2.3.8 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-2600](https://cve.now/CVE-2026-2600.md): ElementsKit Elementor Addons and Templates \<= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget (CVSS 6.4)
- [CVE-2026-3474](https://cve.now/CVE-2026-3474.md): EmailKit \<= 1.6.3 - Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter (CVSS 4.9)
- [CVE-2026-2879](https://cve.now/CVE-2026-2879.md): GetGenie \<= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion (CVSS 5.4)
- [CVE-2026-2257](https://cve.now/CVE-2026-2257.md): GetGenie \<= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API (CVSS 6.4)
- [CVE-2026-23693](https://cve.now/CVE-2026-23693.md): ElementsKit Elementor Addons \< 3.7.9 Unauthenticated Mailchimp REST Endpoint (CVSS 9.3)
- [CVE-2026-1925](https://cve.now/CVE-2026-1925.md): EmailKit – Email Customizer for WooCommerce & WP \<= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification (CVSS 4.3)
- [CVE-2025-14895](https://cve.now/CVE-2025-14895.md): PopupKit \<= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion (CVSS 5.4)
- [CVE-2025-13192](https://cve.now/CVE-2025-13192.md): Popup builder with Gamification \<= 2.2.0 - Unauthenticated SQL Injection via Multiple REST API Endpoints (CVSS 8.2)
- [CVE-2026-0633](https://cve.now/CVE-2026-0633.md): MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor \<= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value (CVSS 3.7)
- [CVE-2026-24356](https://cve.now/CVE-2026-24356.md): WordPress GetGenie plugin \<= 4.3.0 - Broken Access Control vulnerability (CVSS 4.9)
- [CVE-2026-1003](https://cve.now/CVE-2026-1003.md): GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools \<= 4.3.0 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion (CVSS 4.3)
- [CVE-2025-14059](https://cve.now/CVE-2025-14059.md): EmailKit \<= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path Traversal (CVSS 6.5)
- [CVE-2025-14441](https://cve.now/CVE-2025-14441.md): Popupkit \<= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Subscriber Data Deletion (CVSS 4.3)
- [CVE-2025-69026](https://cve.now/CVE-2025-69026.md): WordPress PopupKit plugin \<= 2.1.5 - Sensitive Data Exposure vulnerability (CVSS 4.3)
- [CVE-2025-14314](https://cve.now/CVE-2025-14314.md): WordPress PopupKit plugin \<= 2.1.5 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-63057](https://cve.now/CVE-2025-63057.md): WordPress Wp Ultimate Review plugin \<= 2.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-13620](https://cve.now/CVE-2025-13620.md): Wp Social Login and Register Social Counter \<= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tampering (CVSS 5.3)
- [CVE-2025-12358](https://cve.now/CVE-2025-12358.md): ShopEngine \<= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation (CVSS 4.3)
- [CVE-2025-11888](https://cve.now/CVE-2025-11888.md): ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution \<= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update (CVSS 2.7)
- [CVE-2025-10861](https://cve.now/CVE-2025-10861.md): Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers \<= 2.1.4 - Unauthenticated Server-Side Request Forgery (CVSS 7.5)
- [CVE-2025-10862](https://cve.now/CVE-2025-10862.md): Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers \<= 2.1.3 - Unauthenticated SQL Injection via 'id' (CVSS 7.5)
- [CVE-2025-60106](https://cve.now/CVE-2025-60106.md): WordPress EmailKit Plugin \<= 1.6.0 - Arbitrary Content Deletion Vulnerability (CVSS 4.9)
- [CVE-2025-10173](https://cve.now/CVE-2025-10173.md): ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution \<= 4.8.3 - Insufficient Authorization to Authenticated (Editor+) Settings Update (CVSS 2.7)
- [CVE-2025-48302](https://cve.now/CVE-2025-48302.md): WordPress FundEngine Plugin \<= 1.7.4 - Local File Inclusion Vulnerability (CVSS 7.5)
- [CVE-2025-5684](https://cve.now/CVE-2025-5684.md): MetForm \<= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via \`mf-template\` DOM Element (CVSS 6.4)
- [CVE-2025-3614](https://cve.now/CVE-2025-3614.md): ElementsKit Elementor Addons and Templates \<= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Widget (CVSS 6.4)
- [CVE-2025-4479](https://cve.now/CVE-2025-4479.md): ElementsKit Lite \<= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget (CVSS 6.4)
- [CVE-2025-47459](https://cve.now/CVE-2025-47459.md): WordPress WP Fundraising Donation and Crowdfunding Platform plugin \<= 1.7.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
- [CVE-2024-11180](https://cve.now/CVE-2024-11180.md): ElementsKit Elementor addons \<= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-30914](https://cve.now/CVE-2025-30914.md): WordPress Metform Elementor Contact Form Builder plugin \<= 3.9.7 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4)
- [CVE-2025-1506](https://cve.now/CVE-2025-1506.md): Wp Social Login and Register Social Counter \<= 3.1.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3)
- [CVE-2025-0968](https://cve.now/CVE-2025-0968.md): ElementsKit Elementor addons \<= 3.4.0 - Unauthenticated Information Exposure via get\_megamenu\_content Function (CVSS 5.3)
- [CVE-2025-1005](https://cve.now/CVE-2025-1005.md): ElementsKit Elementor addons \<= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget (CVSS 6.4)
- [CVE-2023-50903](https://cve.now/CVE-2023-50903.md): WordPress Metform Elementor Contact Form Builder plugin \<= 3.4.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-37255](https://cve.now/CVE-2024-37255.md): WordPress ElementsKit Lite plugin \<= 3.1.4 - Unauthenticated Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-9501](https://cve.now/CVE-2024-9501.md): Wp Social Login and Register Social Counter \<= 3.0.7 - Authentication Bypass via WordPress.com OAuth provider (CVSS 9.8)
- [CVE-2024-10091](https://cve.now/CVE-2024-10091.md): ElementsKit Elementor addons \<= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget (CVSS 6.4)
- [CVE-2024-8546](https://cve.now/CVE-2024-8546.md): ElementsKit Elementor addons \<= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget (CVSS 6.4)
- [CVE-2023-0714](https://cve.now/CVE-2023-0714.md): Metform Elementor Contact Form Builder \<= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload (CVSS 8.1)
- [CVE-2024-6698](https://cve.now/CVE-2024-6698.md): FundEngine – Donation and Crowdfunding Platform \<= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8)
- [CVE-2024-6455](https://cve.now/CVE-2024-6455.md): ElementsKit Elementor addons \<= 3.2.0 - Unauthenticated Information Exposure via ekit\_widgetarea\_content Function (CVSS 5.3)
- [CVE-2024-4266](https://cve.now/CVE-2024-4266.md): MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor \<= 3.8.8 - Unauthenticated Sensitive Information Exposure (CVSS 5.3)
- [CVE-2024-21746](https://cve.now/CVE-2024-21746.md): WordPress Wp Ultimate Review plugin \<= 2.3.6 - IP limit Bypass vulnerability (CVSS 5.3)
- [CVE-2024-33570](https://cve.now/CVE-2024-33570.md): WordPress MetForm plugin \<= 3.8.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-3499](https://cve.now/CVE-2024-3499.md): ElementsKit Elementor addons \<= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Onepage Scroll Module (CVSS 8.8)
- [CVE-2024-32505](https://cve.now/CVE-2024-32505.md): WordPress ElementsKit Elementor addons plugin \<= 3.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-2803](https://cve.now/CVE-2024-2803.md): ElementsKit Elementor addons \<= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4)
- [CVE-2024-2791](https://cve.now/CVE-2024-2791.md): Metform Elementor Contact Form Builder \<= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets (CVSS 6.4)
- [CVE-2024-1238](https://cve.now/CVE-2024-1238.md): ElementsKit Elementor addons \<= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-2047](https://cve.now/CVE-2024-2047.md): ElementsKit Elementor addons \<= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render\_raw (CVSS 8.8)
- [CVE-2023-6525](https://cve.now/CVE-2023-6525.md): ElementsKit Elementor addons \<= 3.0.3 - Authenticated(Editor+) Stored Cross-Site Scripting (CVSS 5.5)
- [CVE-2024-2042](https://cve.now/CVE-2024-2042.md): ElementsKit Elementor addons \<= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget (CVSS 6.4)
- [CVE-2024-1239](https://cve.now/CVE-2024-1239.md): ElementsKit Elementor addons \<= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-1763](https://cve.now/CVE-2024-1763.md): Wp Social Login and Register Social Counter \<= 3.0.0 - Missing Authorization to Unauthenticated Social Login/Share Status Update (CVSS 6.5)
- [CVE-2024-1585](https://cve.now/CVE-2024-1585.md): Metform Elementor Contact Form Builder \<= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2023-6582](https://cve.now/CVE-2023-6582.md): ElementsKit Lite \<= 3.0.3 - Unauthenticated Sensitive Information Exposure (CVSS 5.3)
- [CVE-2023-6788](https://cve.now/CVE-2023-6788.md): Metform Elementor Contact Form Builder \<= 3.8.1 - Cross-Site Request Forgery (CVSS 5.4)
- [CVE-2023-0689](https://cve.now/CVE-2023-0689.md): Metform Elementor Contact Form Builder \<= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf\_first\_name' shortcode (CVSS 4.3)
- [CVE-2023-2517](https://cve.now/CVE-2023-2517.md): Metform Elementor Contact Form Builder \<= 3.3.2 - Cross-Site Request Forgery via permalink\_setup (CVSS 5.4)
- [CVE-2023-0692](https://cve.now/CVE-2023-0692.md): Metform Elementor Contact Form Builder \<= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf\_payment\_status' shortcode (CVSS 4.3)
- [CVE-2023-0721](https://cve.now/CVE-2023-0721.md): Metform Elementor Contact Form Builder \<= 3.3.0 - Unauthenticated CSV Injection (CVSS 8.3)
- [CVE-2023-0708](https://cve.now/CVE-2023-0708.md): Metform Elementor Contact Form Builder \<= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf\_first\_name shortcode (CVSS 5.4)
- [CVE-2023-0691](https://cve.now/CVE-2023-0691.md): Metform Elementor Contact Form Builder \<= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf\_last\_name shortcode (CVSS 4.3)
- [CVE-2023-0710](https://cve.now/CVE-2023-0710.md): Metform Elementor Contact Form Builder \<= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf\_thankyou shortcode (CVSS 4.9)
- [CVE-2023-0688](https://cve.now/CVE-2023-0688.md): Metform Elementor Contact Form Builder \<= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf\_thankyou shortcode (CVSS 6.5)
- [CVE-2023-1843](https://cve.now/CVE-2023-1843.md): Metform Elementor Contact Form Builder \<= 3.3.0 - Missing Authorization (CVSS 6.5)
- [CVE-2023-0709](https://cve.now/CVE-2023-0709.md): Metform Elementor Contact Form Builder \<= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf\_last\_name shortcode (CVSS 5.4)
- [CVE-2023-0693](https://cve.now/CVE-2023-0693.md): Metform Elementor Contact Form Builder \<= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf\_transaction\_id' shortcode (CVSS 6.5)
- [CVE-2023-0695](https://cve.now/CVE-2023-0695.md): Metform Elementor Contact Form Builder \<= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode (CVSS 5.4)
- [CVE-2023-0694](https://cve.now/CVE-2023-0694.md): Metform Elementor Contact Form Builder \<= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode (CVSS 6.5)
- [CVE-2023-0084](https://cve.now/CVE-2023-0084.md): Metform Elementor Contact Form Builder \<= 3.1.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2023-0085](https://cve.now/CVE-2023-0085.md): Metform Elementor Contact Form Builder \<= 3.2.1 - reCaptcha Protection Bypass (CVSS 5.3)
- [CVE-2022-1442](https://cve.now/CVE-2022-1442.md): Metform Elementor Contact Form Builder \<= 2.1.3 - Sensitive Information Disclosure (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/roxnor
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.