Wpxpo vulnerabilities
36 CVEs and advisories name Wpxpo as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-8145WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration'
- CVE-2026-96840Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field
- CVE-2026-5158PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block
- CVE-2026-17161WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute
- CVE-2026-17162WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute
- CVE-2026-15100Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute
- CVE-2026-57377WordPress WowAddons plugin <= 1.6.8 - Broken Access Control vulnerability
- CVE-2026-13253Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute
- CVE-2026-57686WordPress WowAddons plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-2518FastX <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activation
- CVE-2026-0718Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification
- CVE-2026-39700WordPress WowOptin plugin <= 1.4.32 - Broken Access Control vulnerability
- CVE-2026-4302WowOptin: Next-Gen Popup Maker <= 1.4.29 - Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API
- CVE-2026-2579WowStore – Store Builder & Product Blocks for WooCommerce <= 4.4.3 - Unauthenticated SQL Injection via 'search' Parameter
- CVE-2026-1720WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation <= 1.4.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
- CVE-2026-1273PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints
- CVE-2026-2001WowRevenue <= 2.1.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
- CVE-2025-69313WordPress PostX plugin <= 5.0.3 - Broken Access Control vulnerability
- CVE-2025-68606WordPress PostX plugin <= 5.0.3 - Sensitive Data Exposure vulnerability
- CVE-2025-12980Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure
- CVE-2025-55707WordPress PostX Plugin <= 4.1.35 - Privilege Escalation Vulnerability
- CVE-2025-54751WordPress PostX plugin <= 4.1.36 - Broken Access Control vulnerability
- CVE-2025-62070WordPress WowRevenue plugin <= 1.2.13 - Broken Access Control vulnerability
- CVE-2025-39571WordPress WowStore plugin <= 4.2.4 - Broken Access Control Vulnerability
- CVE-2025-31096WordPress PostX plugin <= 4.1.25 - Cross Site Scripting (XSS) Vulnerability
- CVE-2023-45271WordPress ProductX – Gutenberg WooCommerce Blocks plugin <= 2.7.8 - Broken Access Control vulnerability
- CVE-2024-53818WordPress PostX plugin <= 4.1.15 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-50513WordPress PostX plugin <= 4.1.15 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-10728PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation
- CVE-2024-50443WordPress PostX plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability