Stellarwp vulnerabilities
137 CVEs and advisories name Stellarwp as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-50046WordPress WPComplete plugin <= 2.9.5 - Cross Site Scripting (XSS) Vulnerability
- CVE-2025-4571GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification
- CVE-2025-5144The Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
- CVE-2025-48246WordPress The Events Calendar plugin <= 6.11.2.1 - Broken Access Control Vulnerability
- CVE-2025-39557WordPress Kadence WooCommerce Email Designer plugin <= 1.5.14 - Arbitrary File Upload vulnerability
- CVE-2025-30794WordPress Event Tickets plugin <= 5.20.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2025-2331GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure
- CVE-2025-2025Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function
- CVE-2025-0912GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection
- CVE-2025-1291Gutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon'
- CVE-2025-22633WordPress Give – Divi Donation Modules plugin <= 2.0.0 - Sensitive Data Exposure vulnerability
- CVE-2025-1402Event Tickets and Registration <= 5.19.1.1 - Missing Authorization to Ticket Deletion
- CVE-2024-13457Event Tickets <= 5.18.1 - Insecure Direct Object Reference to Sensitive Information Exposure
- CVE-2025-24537WordPress The Events Calendar plugin <= 6.7.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-11090Membership Plugin – Restrict Content <= 3.2.13 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- CVE-2025-24753WordPress Kadence Blocks plugin <= 3.3.1 - Broken Access Control vulnerability
- CVE-2024-12118The Events Calendar <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2025-22777WordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerability
- CVE-2024-12877GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection
- CVE-2024-12304Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link
- CVE-2024-38762WordPress Event Tickets and Registration plugin <= 5.11.0.4 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-37518WordPress The Events Calendar plugin <= 6.5.1.4 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2023-47183WordPress GiveWP plugin <= 2.33.1 - Broken Access Control vulnerability
- CVE-2024-12581Kadence Blocks <= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting
- CVE-2024-10785Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-9655Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget
- CVE-2022-4974Freemius SDK <= 2.4.2 - Missing Authorization Checks
- CVE-2024-9634GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution
- CVE-2024-8353GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection
- CVE-2024-6931The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting