# cve.now: Stellarwp

The newest entries naming Stellarwp as an affected vendor (up to 200), of 137 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-118193](https://cve.now/CVE-2026-118193.md): GiveWP \<= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor\_default\_user\_role' Parameter (CVSS 8.8)
- [CVE-2026-97643](https://cve.now/CVE-2026-97643.md): GiveWP \<= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp\_campaign\_grid Shortcode Attributes (CVSS 6.4)
- [CVE-2026-104762](https://cve.now/CVE-2026-104762.md): Kadence Blocks \<= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute (CVSS 6.4)
- [CVE-2026-97634](https://cve.now/CVE-2026-97634.md): Event Tickets and Registration \<= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter (CVSS 6.5)
- [CVE-2026-77820](https://cve.now/CVE-2026-77820.md): WPComplete \<= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-78159](https://cve.now/CVE-2026-78159.md): The Events Calendar \<= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation (CVSS 9.8)
- [CVE-2026-78006](https://cve.now/CVE-2026-78006.md): The Events Calendar \<= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution (CVSS 9.8)
- [CVE-2026-3174](https://cve.now/CVE-2026-3174.md): Event Tickets and Registration \<= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update (CVSS 7.5)
- [CVE-2026-12843](https://cve.now/CVE-2026-12843.md): LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint (CVSS 5.4)
- [CVE-2026-12483](https://cve.now/CVE-2026-12483.md): LearnDash LMS \<= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler (CVSS 7.5)
- [CVE-2026-5510](https://cve.now/CVE-2026-5510.md): GiveWP \<= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4)
- [CVE-2026-9273](https://cve.now/CVE-2026-9273.md): Membership Plugin – Kadence Memberships \<= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover (CVSS 9.3)
- [CVE-2026-18062](https://cve.now/CVE-2026-18062.md): Kadence Blocks \<= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content (CVSS 6.4)
- [CVE-2026-18435](https://cve.now/CVE-2026-18435.md): Kadence Blocks \<= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute (CVSS 6.4)
- [CVE-2026-14987](https://cve.now/CVE-2026-14987.md): GiveWP \<= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter\_message' Sequoia Template Setting (CVSS 6.4)
- [CVE-2026-15286](https://cve.now/CVE-2026-15286.md): Gutenberg Blocks with AI by Kadence WP – Page Builder Features \<= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication (CVSS 4.3)
- [CVE-2026-13704](https://cve.now/CVE-2026-13704.md): GiveWP \<= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form (CVSS 6.4)
- [CVE-2026-11981](https://cve.now/CVE-2026-11981.md): GiveWP \<= 4.15.3 - Cross-Site Request Forgery (CVSS 4.3)
- [CVE-2026-12902](https://cve.now/CVE-2026-12902.md): Kadence Blocks \<= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence\_import\_process\_pattern/kadence\_import\_process\_data AJAX Actions (CVSS 4.3)
- [CVE-2026-12904](https://cve.now/CVE-2026-12904.md): Kadence Blocks \<= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post\_path' Parameter (CVSS 4.3)
- [CVE-2026-13246](https://cve.now/CVE-2026-13246.md): GiveWP \<= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block\_id' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-11357](https://cve.now/CVE-2026-11357.md): Kadence Blocks \<= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization (CVSS 4.3)
- [CVE-2026-42642](https://cve.now/CVE-2026-42642.md): WordPress GiveWP plugin \<= 4.14.5 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-42643](https://cve.now/CVE-2026-42643.md): WordPress Image Widget plugin \<= 4.4.11 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2026-2826](https://cve.now/CVE-2026-2826.md): Kadence Blocks — Page Builder Toolkit for Gutenberg Editor \<= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload (CVSS 4.3)
- [CVE-2026-32546](https://cve.now/CVE-2026-32546.md): WordPress Restrict Content plugin \<= 3.2.22 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-3079](https://cve.now/CVE-2026-3079.md): LearnDash LMS \<= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters\[orderby\_order\]' Parameter (CVSS 6.5)
- [CVE-2026-4136](https://cve.now/CVE-2026-4136.md): Membership Plugin – Restrict Content \<= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp\_redirect (CVSS 4.3)
- [CVE-2026-3585](https://cve.now/CVE-2026-3585.md): The Events Calendar \<= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax\_create\_import (CVSS 7.5)
- [CVE-2026-1321](https://cve.now/CVE-2026-1321.md): Membership Plugin – Restrict Content \<= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp\_level' (CVSS 8.1)
- [CVE-2026-2694](https://cve.now/CVE-2026-2694.md): The Events Calendar \<= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API (CVSS 5.4)
- [CVE-2026-27056](https://cve.now/CVE-2026-27056.md): WordPress iThemes Sync plugin \<= 3.2.8 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-2633](https://cve.now/CVE-2026-2633.md): Gutenberg Blocks with AI by Kadence WP \<= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload (CVSS 4.3)
- [CVE-2026-1857](https://cve.now/CVE-2026-1857.md): Gutenberg Blocks with AI by Kadence WP \<= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter (CVSS 4.3)
- [CVE-2026-1304](https://cve.now/CVE-2026-1304.md): Membership Plugin – Restrict Content \<= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings (CVSS 4.4)
- [CVE-2026-2608](https://cve.now/CVE-2026-2608.md): Gutenberg Blocks by Kadence Blocks \<= 3.5.32 - Missing Authorization (CVSS 4.3)
- [CVE-2025-15043](https://cve.now/CVE-2025-15043.md): The Events Calendar \<= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control (CVSS 5.4)
- [CVE-2025-14844](https://cve.now/CVE-2025-14844.md): Membership Plugin – Restrict Content \<= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure (CVSS 8.2)
- [CVE-2025-69352](https://cve.now/CVE-2025-69352.md): WordPress The Events Calendar plugin \<= 6.15.12.2 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-14000](https://cve.now/CVE-2025-14000.md): Membership Plugin – Restrict Content \<= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes (CVSS 6.4)
- [CVE-2025-67467](https://cve.now/CVE-2025-67467.md): WordPress GiveWP plugin \<= 4.13.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2025-13387](https://cve.now/CVE-2025-13387.md): Kadence WooCommerce Email Designer \<= 1.5.17 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2025-13206](https://cve.now/CVE-2025-13206.md): GiveWP - Donation Plugin and Fundraising Platform \<= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name' (CVSS 7.2)
- [CVE-2025-12633](https://cve.now/CVE-2025-12633.md): Booking Calendar | Appointment Booking | Bookit \<= 2.5.0 - Missing Authorization to Unauthenticated Stripe Connection (CVSS 7.5)
- [CVE-2025-12192](https://cve.now/CVE-2025-12192.md): The Events Calendar \<= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure (CVSS 5.3)
- [CVE-2025-12197](https://cve.now/CVE-2025-12197.md): The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s (CVSS 7.5)
- [CVE-2025-12175](https://cve.now/CVE-2025-12175.md): The Events Calendar \<= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure (CVSS 4.3)
- [CVE-2025-62027](https://cve.now/CVE-2025-62027.md): WordPress Event Tickets plugin \<= 5.26.3 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-49906](https://cve.now/CVE-2025-49906.md): WordPress WPComplete plugin \<= 2.9.5.3 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-11517](https://cve.now/CVE-2025-11517.md): Event Tickets and Registration \<= 5.26.5 - Unauthenticated Ticket Payment Bypass (CVSS 7.5)
- [CVE-2025-11228](https://cve.now/CVE-2025-11228.md): GiveWP – Donation Plugin and Fundraising Platform \<= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association (CVSS 5.3)
- [CVE-2025-11227](https://cve.now/CVE-2025-11227.md): GiveWP – Donation Plugin and Fundraising Platform \<= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure (CVSS 6.5)
- [CVE-2025-58974](https://cve.now/CVE-2025-58974.md): WordPress WPComplete Plugin \<= 2.9.5.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-9808](https://cve.now/CVE-2025-9808.md): The Events Calendar \<= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure (CVSS 5.3)
- [CVE-2025-9807](https://cve.now/CVE-2025-9807.md): The Events Calendar \<= 6.15.1 - Unauthenticated SQL Injection (CVSS 7.5)
- [CVE-2025-7221](https://cve.now/CVE-2025-7221.md): GiveWP – Donation Plugin and Fundraising Platform \<= 4.5.0 - Missing Authorization to Donation Update (CVSS 4.3)
- [CVE-2025-54697](https://cve.now/CVE-2025-54697.md): WordPress Kadence WooCommerce Email Designer Plugin \<= 1.5.16 - Privilege Escalation Vulnerability (CVSS 7.2)
- [CVE-2025-8620](https://cve.now/CVE-2025-8620.md): GiveWP – Donation Plugin and Fundraising Platform \<= 4.6.0 - Unauthenticated Donor Data Exposure (CVSS 5.3)
- [CVE-2025-7205](https://cve.now/CVE-2025-7205.md): GiveWP – Donation Plugin and Fundraising Platform \<= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting (CVSS 5.4)
- [CVE-2025-5678](https://cve.now/CVE-2025-5678.md): Kadence Blocks – Gutenberg Blocks for Page Builder Features \<= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via \`redirectURL\` Parameter (CVSS 6.4)
- [CVE-2025-50046](https://cve.now/CVE-2025-50046.md): WordPress WPComplete plugin \<= 2.9.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-4571](https://cve.now/CVE-2025-4571.md): GiveWP – Donation Plugin and Fundraising Platform \<= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification (CVSS 5.4)
- [CVE-2025-5144](https://cve.now/CVE-2025-5144.md): The Events Calendar \<= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-48246](https://cve.now/CVE-2025-48246.md): WordPress The Events Calendar plugin \<= 6.11.2.1 - Broken Access Control Vulnerability (CVSS 5.4)
- [CVE-2025-39557](https://cve.now/CVE-2025-39557.md): WordPress Kadence WooCommerce Email Designer plugin \<= 1.5.14 - Arbitrary File Upload vulnerability (CVSS 9.1)
- [CVE-2025-30794](https://cve.now/CVE-2025-30794.md): WordPress Event Tickets plugin \<= 5.20.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-2331](https://cve.now/CVE-2025-2331.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 5.3)
- [CVE-2025-2025](https://cve.now/CVE-2025-2025.md): Give \<= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give\_reports\_earnings Function (CVSS 6.5)
- [CVE-2025-0912](https://cve.now/CVE-2025-0912.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.19.4 - Unauthenticated PHP Object Injection (CVSS 9.8)
- [CVE-2025-1291](https://cve.now/CVE-2025-1291.md): Gutenberg Blocks by Kadence Blocks \<= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' (CVSS 6.4)
- [CVE-2025-22633](https://cve.now/CVE-2025-22633.md): WordPress Give – Divi Donation Modules plugin \<= 2.0.0 - Sensitive Data Exposure vulnerability (CVSS 5.8)
- [CVE-2025-1402](https://cve.now/CVE-2025-1402.md): Event Tickets and Registration \<= 5.19.1.1 - Missing Authorization to Ticket Deletion (CVSS 5.3)
- [CVE-2024-13457](https://cve.now/CVE-2024-13457.md): Event Tickets \<= 5.18.1 - Insecure Direct Object Reference to Sensitive Information Exposure (CVSS 5.3)
- [CVE-2025-24537](https://cve.now/CVE-2025-24537.md): WordPress The Events Calendar plugin \<= 6.7.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2024-11090](https://cve.now/CVE-2024-11090.md): Membership Plugin – Restrict Content \<= 3.2.13 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3)
- [CVE-2025-24753](https://cve.now/CVE-2025-24753.md): WordPress Kadence Blocks plugin \<= 3.3.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-12118](https://cve.now/CVE-2024-12118.md): The Events Calendar \<= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-22777](https://cve.now/CVE-2025-22777.md): WordPress GiveWP Plugin \<= 3.19.3 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2024-12877](https://cve.now/CVE-2024-12877.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.19.2 - Unauthenticated PHP Object Injection (CVSS 9.8)
- [CVE-2024-12304](https://cve.now/CVE-2024-12304.md): Gutenberg Blocks with AI by Kadence WP – Page Builder Features \<= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link (CVSS 6.4)
- [CVE-2024-38762](https://cve.now/CVE-2024-38762.md): WordPress Event Tickets and Registration plugin \<= 5.11.0.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-37518](https://cve.now/CVE-2024-37518.md): WordPress The Events Calendar plugin \<= 6.5.1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2023-47183](https://cve.now/CVE-2023-47183.md): WordPress GiveWP plugin \<= 2.33.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-12581](https://cve.now/CVE-2024-12581.md): Kadence Blocks \<= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4)
- [CVE-2024-10785](https://cve.now/CVE-2024-10785.md): Gutenberg Blocks with AI by Kadence WP – Page Builder Features \<= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-9655](https://cve.now/CVE-2024-9655.md): Gutenberg Blocks with AI by Kadence WP – Page Builder Features \<= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget (CVSS 6.4)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- [CVE-2024-9634](https://cve.now/CVE-2024-9634.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution (CVSS 9.8)
- [CVE-2024-8353](https://cve.now/CVE-2024-8353.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.16.1 - Unauthenticated PHP Object Injection (CVSS 9.8)
- [CVE-2024-6931](https://cve.now/CVE-2024-6931.md): The Events Calendar \<= 6.6.3 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2024-9130](https://cve.now/CVE-2024-9130.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter (CVSS 7.2)
- [CVE-2024-47315](https://cve.now/CVE-2024-47315.md): WordPress GiveWP – Donation Plugin and Fundraising Platform plugin \<= 3.15.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2024-8275](https://cve.now/CVE-2024-8275.md): The Events Calendar \<= 6.6.4 - Unauthenticated SQL Injection (CVSS 9.8)
- [CVE-2024-6551](https://cve.now/CVE-2024-6551.md): GiveWP \<= 3.15.1 - Unauthenticated Full Path Disclosure (CVSS 5.3)
- [CVE-2024-5940](https://cve.now/CVE-2024-5940.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update (CVSS 6.5)
- [CVE-2024-5939](https://cve.now/CVE-2024-5939.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.13.0 - Missing Authorization to Limited Information Exposure (CVSS 5.3)
- [CVE-2024-5932](https://cve.now/CVE-2024-5932.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution (CVSS 10.0)
- [CVE-2024-5941](https://cve.now/CVE-2024-5941.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion (CVSS 5.4)
- [CVE-2024-5977](https://cve.now/CVE-2024-5977.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions (CVSS 5.4)
- [CVE-2024-5648](https://cve.now/CVE-2024-5648.md): LearnDash LMS - Reports Free \<= 1.8.2.1 - Missing Authorization to Plugin Settings Update (CVSS 5.4)
- [CVE-2024-5819](https://cve.now/CVE-2024-5819.md): Gutenberg Blocks with AI by Kadence WP – Page Builder Features \<= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes (CVSS 6.4)
- [CVE-2024-5289](https://cve.now/CVE-2024-5289.md): Gutenberg Blocks with AI by Kadence WP – Page Builder Features \<= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget (CVSS 6.4)
- [CVE-2024-4863](https://cve.now/CVE-2024-4863.md): Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter (CVSS 6.4)
- [CVE-2024-35679](https://cve.now/CVE-2024-35679.md): WordPress GiveWP plugin \<= 3.12.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-3714](https://cve.now/CVE-2024-3714.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-4208](https://cve.now/CVE-2024-4208.md): Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect (CVSS 6.4)
- [CVE-2024-3189](https://cve.now/CVE-2024-3189.md): Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
- [CVE-2024-4209](https://cve.now/CVE-2024-4209.md): Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer (CVSS 6.4)
- [CVE-2024-4481](https://cve.now/CVE-2024-4481.md): Gutenberg Blocks with AI by Kadence WP \<= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link (CVSS 6.4)
- [CVE-2024-2273](https://cve.now/CVE-2024-2273.md): Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-4034](https://cve.now/CVE-2024-4034.md): Virtue \<= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author (CVSS 6.4)
- [CVE-2024-31432](https://cve.now/CVE-2024-31432.md): WordPress Restrict Content plugin \<= 3.2.8 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-31433](https://cve.now/CVE-2024-31433.md): WordPress The Events Calendar plugin \<= 6.3.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-1957](https://cve.now/CVE-2024-1957.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2024-1424](https://cve.now/CVE-2024-1424.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-1999](https://cve.now/CVE-2024-1999.md): Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget (CVSS 6.4)
- [CVE-2023-6964](https://cve.now/CVE-2023-6964.md): Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF) (CVSS 8.5)
- [CVE-2024-0598](https://cve.now/CVE-2024-0598.md): Gutenberg Blocks by Kadence Blocks \<= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings (CVSS 4.4)
- [CVE-2024-2261](https://cve.now/CVE-2024-2261.md): Event Tickets and Registration \<= 5.8.2 - Improper Authorization to Information Disclosure (CVSS 4.3)
- [CVE-2024-2919](https://cve.now/CVE-2024-2919.md): Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via CountUp Widget (CVSS 6.4)
- [CVE-2024-24888](https://cve.now/CVE-2024-24888.md): WordPress Gutenberg Blocks by Kadence Blocks plugin \<= 3.2.25 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4)
- [CVE-2024-23500](https://cve.now/CVE-2024-23500.md): WordPress Kadence Blocks plugin \<= 3.2.19 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.7)
- [CVE-2024-30229](https://cve.now/CVE-2024-30229.md): WordPress Give plugin \<= 3.4.2 - PHP Object Injection vulnerability (CVSS 8.0)
- [CVE-2024-27987](https://cve.now/CVE-2024-27987.md): WordPress Give plugin \<= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-1541](https://cve.now/CVE-2024-1541.md): Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-1053](https://cve.now/CVE-2024-1053.md): Event Tickets and Registration \<= 5.8.1 - Missing Authorization (CVSS 4.3)
- [CVE-2023-6557](https://cve.now/CVE-2023-6557.md): The Events Calendar \<= 6.2.8.2 - Unauthenticated Sensitive Information Exposure (CVSS 5.3)
- [CVE-2024-1208](https://cve.now/CVE-2024-1208.md): LearnDash LMS \<= 4.10.2 - Sensitive Information Exposure via API (CVSS 5.3)
- [CVE-2024-1209](https://cve.now/CVE-2024-1209.md): LearnDash LMS \<= 4.10.1 - Sensitive Information Exposure via assignments (CVSS 5.3)
- [CVE-2024-1210](https://cve.now/CVE-2024-1210.md): LearnDash LMS \<= 4.10.1 - Sensitive Information Exposure via API (CVSS 5.3)
- [CVE-2023-4247](https://cve.now/CVE-2023-4247.md): GiveWP \<= 2.33.3 - Cross-Site Request Forgery to plugin deactivation (CVSS 5.4)
- [CVE-2023-4246](https://cve.now/CVE-2023-4246.md): GiveWP \<= 2.33.3 - Cross-Site Request Forgery to plugin installation (CVSS 4.3)
- [CVE-2023-4248](https://cve.now/CVE-2023-4248.md): GiveWP \<= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion (CVSS 5.4)
- [CVE-2023-47668](https://cve.now/CVE-2023-47668.md): WordPress Restrict Content Plugin \<= 3.2.7 is vulnerable to Sensitive Data Exposure (CVSS 5.3)
- [CVE-2023-3105](https://cve.now/CVE-2023-3105.md): LearnDash LMS \<= 4.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change (CVSS 8.8)
- [CVE-2023-2834](https://cve.now/CVE-2023-2834.md): BookIt \<= 2.3.7 - Authentication Bypass (CVSS 9.8)
- [CVE-2022-2117](https://cve.now/CVE-2022-2117.md): GiveWP – Donation Plugin and Fundraising Platform \<= 2.20.2 - Sensitive Information Disclosure (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/stellarwp
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.