# cve.now: Wpmet

The newest entries naming Wpmet as an affected vendor (up to 200), of 34 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-122673](https://cve.now/CVE-2026-122673.md): WordPress ShopEngine plugin \<= 4.9.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-120847](https://cve.now/CVE-2026-120847.md): WordPress Metform plugin \<= 4.3.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-122675](https://cve.now/CVE-2026-122675.md): WordPress Wp Social plugin \<= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2026-114180](https://cve.now/CVE-2026-114180.md): WordPress Metform plugin \<= 4.3.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-103339](https://cve.now/CVE-2026-103339.md): WordPress Metform plugin \<= 4.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-103063](https://cve.now/CVE-2026-103063.md): WordPress ElementsKit Elementor addons Lite plugin \<= 4.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-103064](https://cve.now/CVE-2026-103064.md): WordPress ElementsKit Elementor addons Lite plugin \<= 4.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-4246](https://cve.now/CVE-2026-4246.md): ElementsKit Pro \<= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter (CVSS 6.1)
- [CVE-2026-24611](https://cve.now/CVE-2026-24611.md): WordPress MetForm Pro plugin \<= 3.9.1 - Broken Access Control vulnerability (CVSS 9.1)
- [CVE-2026-24610](https://cve.now/CVE-2026-24610.md): WordPress MetForm Pro plugin \<= 3.9.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-54197](https://cve.now/CVE-2026-54197.md): WordPress GetGenie plugin \<= 4.4.1 - Sensitive Data Exposure vulnerability (CVSS 6.5)
- [CVE-2026-49053](https://cve.now/CVE-2026-49053.md): WordPress ElementsKit Elementor addons Lite plugin \<= 3.9.6 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-49052](https://cve.now/CVE-2026-49052.md): WordPress ElementsKit Elementor addons Lite plugin \<= 3.9.6 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-1782](https://cve.now/CVE-2026-1782.md): MetForm Pro \<= 3.9.7 - Unauthenticated Payment Amount Manipulation via 'mf-calculation' (CVSS 5.3)
- [CVE-2026-1261](https://cve.now/CVE-2026-1261.md): MetForm Pro \<= 3.9.6 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2025-0321](https://cve.now/CVE-2025-0321.md): ElementsKit Pro \<= 3.7.8 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via url Parameter (CVSS 6.4)
- [CVE-2024-7063](https://cve.now/CVE-2024-7063.md): ElementsKit Pro \<= 3.6.6 - Authenticated (Contributor+) Sensitive Information Exposure (CVSS 4.3)
- [CVE-2024-7064](https://cve.now/CVE-2024-7064.md): ElementsKit Pro \<= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2023-39993](https://cve.now/CVE-2023-39993.md): WordPress ElementsKit Lite plugin \<= 2.9.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-5263](https://cve.now/CVE-2024-5263.md): ElementsKit Elementor addons and Templates Library \<= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table Widgets (CVSS 6.4)
- [CVE-2024-4404](https://cve.now/CVE-2024-4404.md): ElementsKit PRO \<= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery (CVSS 8.5)
- [CVE-2024-34758](https://cve.now/CVE-2024-34758.md): WordPress FundEngine – Donation and Crowdfunding Platform plugin \<= 1.6.4 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-4452](https://cve.now/CVE-2024-4452.md): ElementsKit Pro \<= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-32685](https://cve.now/CVE-2024-32685.md): WordPress WP Ultimate Review plugin \<= 2.2.5 - Review Score Manipulation vulnerability (CVSS 5.3)
- [CVE-2024-3500](https://cve.now/CVE-2024-3500.md): ElementsKit Pro \<= 3.6.0 - Authenticated (Contributor+) Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets (CVSS 8.8)
- [CVE-2024-32684](https://cve.now/CVE-2024-32684.md): WordPress WP Ultimate Review plugin \<= 2.2.5 - Broken Access Control on Review vulnerability (CVSS 5.3)
- [CVE-2024-32683](https://cve.now/CVE-2024-32683.md): WordPress WP Ultimate Review plugin \<= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
- [CVE-2024-3598](https://cve.now/CVE-2024-3598.md): ElementsKit Pro \<= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ekit\_btn\_id' (CVSS 6.4)
- [CVE-2022-47160](https://cve.now/CVE-2022-47160.md): WordPress Wp Social Plugin \<= 1.9.0 is vulnerable to Sensitive Data Exposure (CVSS 6.5)
- [CVE-2023-28987](https://cve.now/CVE-2023-28987.md): WordPress Wp Ultimate Review Plugin \<= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-46085](https://cve.now/CVE-2023-46085.md): WordPress Wp Ultimate Review Plugin \<= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-28751](https://cve.now/CVE-2023-28751.md): WordPress Wp Ultimate Review Plugin \<= 2.0.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2022-45371](https://cve.now/CVE-2022-45371.md): WordPress ShopEngine Plugin \<= 4.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2021-24258](https://cve.now/CVE-2021-24258.md): ElementsKit and ElementsKit Pro \< 2.2.0 - Contributor+ Stored XSS (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wpmet
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.