# cve.now: Wpxpo

The newest entries naming Wpxpo as an affected vendor (up to 200), of 36 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-8145](https://cve.now/CVE-2026-8145.md): WholesaleX \<= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process\_registration' (CVSS 5.4)
- [CVE-2026-96840](https://cve.now/CVE-2026-96840.md): Post Grid Gutenberg Blocks \<= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display\_name User Field (CVSS 7.2)
- [CVE-2026-5158](https://cve.now/CVE-2026-5158.md): PostX \<= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block (CVSS 6.4)
- [CVE-2026-17161](https://cve.now/CVE-2026-17161.md): WowStore \<= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute (CVSS 6.4)
- [CVE-2026-17162](https://cve.now/CVE-2026-17162.md): WowStore \<= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute (CVSS 6.4)
- [CVE-2026-15100](https://cve.now/CVE-2026-15100.md): Post Grid Gutenberg Blocks \<= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute (CVSS 6.4)
- [CVE-2026-57377](https://cve.now/CVE-2026-57377.md): WordPress WowAddons plugin \<= 1.6.8 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-13253](https://cve.now/CVE-2026-13253.md): Post Grid Gutenberg Blocks for News, Magazines, Blog Websites \<= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute (CVSS 6.4)
- [CVE-2026-57686](https://cve.now/CVE-2026-57686.md): WordPress WowAddons plugin \<= 1.6.14 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-2518](https://cve.now/CVE-2026-2518.md): FastX \<= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activation (CVSS 4.3)
- [CVE-2026-0718](https://cve.now/CVE-2026-0718.md): Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX \<= 5.0.5 - Missing Authorization to Limited Post Meta Modification (CVSS 5.3)
- [CVE-2026-39700](https://cve.now/CVE-2026-39700.md): WordPress WowOptin plugin \<= 1.4.32 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-4302](https://cve.now/CVE-2026-4302.md): WowOptin: Next-Gen Popup Maker \<= 1.4.29 - Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API (CVSS 7.2)
- [CVE-2026-2579](https://cve.now/CVE-2026-2579.md): WowStore – Store Builder & Product Blocks for WooCommerce \<= 4.4.3 - Unauthenticated SQL Injection via 'search' Parameter (CVSS 7.5)
- [CVE-2026-1720](https://cve.now/CVE-2026-1720.md): WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation \<= 1.4.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation (CVSS 8.8)
- [CVE-2026-1273](https://cve.now/CVE-2026-1273.md): PostX \<= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints (CVSS 7.2)
- [CVE-2026-2001](https://cve.now/CVE-2026-2001.md): WowRevenue \<= 2.1.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation (CVSS 8.8)
- [CVE-2025-69313](https://cve.now/CVE-2025-69313.md): WordPress PostX plugin \<= 5.0.3 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2025-68606](https://cve.now/CVE-2025-68606.md): WordPress PostX plugin \<= 5.0.3 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2025-12980](https://cve.now/CVE-2025-12980.md): Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX \<= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 7.5)
- [CVE-2025-55707](https://cve.now/CVE-2025-55707.md): WordPress PostX Plugin \<= 4.1.35 - Privilege Escalation Vulnerability (CVSS 7.2)
- [CVE-2025-54751](https://cve.now/CVE-2025-54751.md): WordPress PostX plugin \<= 4.1.36 - Broken Access Control vulnerability (CVSS 7.1)
- [CVE-2025-62070](https://cve.now/CVE-2025-62070.md): WordPress WowRevenue plugin \<= 1.2.13 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-39571](https://cve.now/CVE-2025-39571.md): WordPress WowStore plugin \<= 4.2.4 - Broken Access Control Vulnerability (CVSS 4.3)
- [CVE-2025-31096](https://cve.now/CVE-2025-31096.md): WordPress PostX plugin \<= 4.1.25 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2023-45271](https://cve.now/CVE-2023-45271.md): WordPress ProductX – Gutenberg WooCommerce Blocks plugin \<= 2.7.8 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-53818](https://cve.now/CVE-2024-53818.md): WordPress PostX plugin \<= 4.1.15 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-50513](https://cve.now/CVE-2024-50513.md): WordPress PostX plugin \<= 4.1.15 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-10728](https://cve.now/CVE-2024-10728.md): PostX \<= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation (CVSS 8.8)
- [CVE-2024-50443](https://cve.now/CVE-2024-50443.md): WordPress PostX plugin \<= 4.1.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-31246](https://cve.now/CVE-2024-31246.md): WordPress PostX plugin \<= 3.2.3 - Author+ Post/Page Duplication vulnerability (CVSS 5.4)
- [CVE-2024-5326](https://cve.now/CVE-2024-5326.md): Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX \<= 4.1.2 - Missing Authorization to Arbitrary Options Update (CVSS 8.8)
- [CVE-2024-5223](https://cve.now/CVE-2024-5223.md): Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX \<= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-32564](https://cve.now/CVE-2024-32564.md): WordPress PostX plugin \<= 4.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-23512](https://cve.now/CVE-2024-23512.md): WordPress ProductX – Gutenberg WooCommerce Blocks Plugin \<= 3.1.4 is vulnerable to PHP Object Injection (CVSS 8.7)
- [CVE-2023-36385](https://cve.now/CVE-2023-36385.md): WordPress PostX – Gutenberg Blocks for Post Grid Plugin \<= 2.9.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wpxpo
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.