Wpwax vulnerabilities
46 CVEs and advisories name Wpwax as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-122661WordPress Directorist plugin <= 8.10.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-119497WordPress Directorist plugin <= 8.10.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-100185Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field
- CVE-2026-17092Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter
- CVE-2026-94499WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability
- CVE-2026-32474WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability
- CVE-2025-15028FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting
- CVE-2026-3141FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter
- CVE-2026-59518WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability
- CVE-2026-49073WordPress Directorist Booking plugin <= 3.0.3 - SQL Injection vulnerability
- CVE-2026-39509WordPress Directorist plugin <= 8.5.10 - Broken Access Control vulnerability
- CVE-2026-22460WordPress FormGent plugin <= 1.7.0 - Arbitrary File Deletion vulnerability
- CVE-2025-68069WordPress Directorist plugin <= 8.6.6 - Broken Access Control vulnerability
- CVE-2025-64250WordPress Directorist plugin <= 8.6.6 - Open Redirection vulnerability
- CVE-2025-66077WordPress Legal Pages plugin <= 1.4.6 - Broken Access Control vulnerability
- CVE-2025-12174Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update
- CVE-2025-10488Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move
- CVE-2025-48242WordPress Legal Pages plugin <= 1.4.5 - Broken Access Control Vulnerability
- CVE-2025-32658WordPress HelpGent plugin <= 2.2.5 - PHP Object Injection vulnerability
- CVE-2025-39525WordPress Logo Carousel Slider plugin <= 2.1.3 - Cross Site Scripting (XSS) Vulnerability
- CVE-2025-32499WordPress Logo Showcase Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerability
- CVE-2025-31857WordPress Directorist AddonsKit for Elementor plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-2224Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing
- CVE-2025-1570Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP
- CVE-2024-12041Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings <= 8.0.12 - Unauthenticated User Information Exposure
- CVE-2025-24782WordPress Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin <= 1.6.10 - Local File Inclusion vulnerability
- CVE-2025-24681WordPress Product Carousel Slider & Grid Ultimate for WooCommerce Plugin <= 1.10.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-13408Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion
- CVE-2024-13409Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion via post_type_ajax_handler()
- CVE-2024-12040Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.10 - Authenticated (Contributor+) Local File Inclusion via 'theme'