Stellarwp vulnerabilities
137 CVEs and advisories name Stellarwp as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-2694The Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API
- CVE-2026-27056WordPress iThemes Sync plugin <= 3.2.8 - Broken Access Control vulnerability
- CVE-2026-2633Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload
- CVE-2026-1857Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter
- CVE-2026-1304Membership Plugin – Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings
- CVE-2026-2608Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization
- CVE-2025-15043The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control
- CVE-2025-14844Membership Plugin – Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure
- CVE-2025-69352WordPress The Events Calendar plugin <= 6.15.12.2 - Broken Access Control vulnerability
- CVE-2025-14000Membership Plugin – Restrict Content <= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
- CVE-2025-67467WordPress GiveWP plugin <= 4.13.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2025-13387Kadence WooCommerce Email Designer <= 1.5.17 - Unauthenticated Stored Cross-Site Scripting
- CVE-2025-13206GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name'
- CVE-2025-12633Booking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe Connection
- CVE-2025-12192The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure
- CVE-2025-12197The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s
- CVE-2025-12175The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure
- CVE-2025-62027WordPress Event Tickets plugin <= 5.26.3 - Broken Access Control vulnerability
- CVE-2025-49906WordPress WPComplete plugin <= 2.9.5.3 - Broken Access Control vulnerability
- CVE-2025-11517Event Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment Bypass
- CVE-2025-11228GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association
- CVE-2025-11227GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure
- CVE-2025-58974WordPress WPComplete Plugin <= 2.9.5.2 - Cross Site Scripting (XSS) Vulnerability
- CVE-2025-9808The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure
- CVE-2025-9807The Events Calendar <= 6.15.1 - Unauthenticated SQL Injection
- CVE-2025-7221GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update
- CVE-2025-54697WordPress Kadence WooCommerce Email Designer Plugin <= 1.5.16 - Privilege Escalation Vulnerability
- CVE-2025-8620GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure
- CVE-2025-7205GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting
- CVE-2025-5678Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter