# cve.now: Wpzoom

The newest entries naming Wpzoom as an affected vendor (up to 200), of 31 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121612](https://cve.now/CVE-2026-121612.md): WordPress WPBruiser {no- Captcha anti-Spam} plugin \<= 3.6.2 - Broken Authentication vulnerability (CVSS 4.3)
- [CVE-2026-100149](https://cve.now/CVE-2026-100149.md): WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons \<= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in \`/yamidoo/v1/customer\`… (CVSS 5.3)
- [CVE-2026-73361](https://cve.now/CVE-2026-73361.md): WordPress Recipe Card Blocks for Gutenberg & Elementor plugin \<= 3.4.18 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-66639](https://cve.now/CVE-2026-66639.md): WordPress WPZOOM Forms – Contact Form plugin for Gutenberg plugin \<= 2.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-57712](https://cve.now/CVE-2026-57712.md): WordPress WPZOOM Portfolio plugin \<= 1.4.29 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-39597](https://cve.now/CVE-2026-39597.md): WordPress WPZOOM Addons for Elementor plugin \<= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-49069](https://cve.now/CVE-2026-49069.md): WordPress WPZOOM Portfolio plugin \<= 1.4.21 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-3011](https://cve.now/CVE-2026-3011.md): Recipe Card Blocks Lite \<= 3.4.13 - Authenticated (Author+) Stored Cross-Site Scripting via 'summary' and 'notes' (CVSS 6.4)
- [CVE-2026-4063](https://cve.now/CVE-2026-4063.md): Social Icons Widget & Block \<= 4.5.8 - Missing Authorization to Authenticated (Subscriber+) Sharing Configuration Creation (CVSS 4.3)
- [CVE-2026-2295](https://cve.now/CVE-2026-2295.md): WPZOOM Addons for Elementor – Starter Templates & Widgets \<= 1.3.2 - Unauthenticated Protected Post Exposure via ajax\_post\_grid\_load\_more (CVSS 5.3)
- [CVE-2025-67951](https://cve.now/CVE-2025-67951.md): WordPress WPZOOM Addons for Elementor plugin \<= 1.2.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-62019](https://cve.now/CVE-2025-62019.md): WordPress Recipe Card Blocks for Gutenberg & Elementor plugin \<= 3.4.8 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-8592](https://cve.now/CVE-2025-8592.md): Inspiro \<= 2.1.2 - Cross-Site Request Forgery to Arbitrary Plugin Installation (CVSS 8.1)
- [CVE-2025-26983](https://cve.now/CVE-2025-26983.md): WordPress Recipe Card Blocks for Gutenberg & Elementor plugin \<= 3.4.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-30424](https://cve.now/CVE-2024-30424.md): WordPress Beaver Builder Addons by WPZOOM plugin \<= 1.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-43293](https://cve.now/CVE-2024-43293.md): WordPress Recipe Card Blocks for Gutenberg & Elementor plugin \<= 3.3.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-9027](https://cve.now/CVE-2024-9027.md): WPZOOM Shortcodes \<= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode (CVSS 6.4)
- [CVE-2024-8276](https://cve.now/CVE-2024-8276.md): WPZOOM Portfolio Lite – Filterable Portfolio Plugin \<= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute (CVSS 6.4)
- [CVE-2024-37464](https://cve.now/CVE-2024-37464.md): WordPress Beaver Builder Addons by WPZOOM plugin \<= 1.3.5 - Local File Inclusion vulnerability (CVSS 4.9)
- [CVE-2024-5686](https://cve.now/CVE-2024-5686.md): WPZOOM Addons for Elementor (Templates, Widgets) \<= 1.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget (CVSS 6.4)
- [CVE-2024-30464](https://cve.now/CVE-2024-30464.md): WordPress Social Icons Widget & Block by WPZOOM plugin \<= 4.2.15 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2024-5147](https://cve.now/CVE-2024-5147.md): WPZOOM Addons for Elementor (Templates, Widgets) \<= 1.1.37 - Unauthenticated Local File Inclusion (CVSS 9.8)
- [CVE-2024-4370](https://cve.now/CVE-2024-4370.md): WPZOOM Addons for Elementor (Templates, Widgets) \<= 1.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget (CVSS 6.4)
- [CVE-2024-33539](https://cve.now/CVE-2024-33539.md): WordPress WPZOOM Addons for Elementor plugin \<= 1.1.35 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-3662](https://cve.now/CVE-2024-3662.md): WPZOOM Social Feed Widget & Block \<= 2.1.13 - Missing Authorization to Authenticated (Subscriber+) Instagram Image Deletion (CVSS 4.3)
- [CVE-2024-2183](https://cve.now/CVE-2024-2183.md): Beaver Builder Addons by WPZOOM \<= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget (CVSS 6.4)
- [CVE-2024-2186](https://cve.now/CVE-2024-2186.md): Beaver Builder Addons by WPZOOM \<= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget (CVSS 6.4)
- [CVE-2024-2181](https://cve.now/CVE-2024-2181.md): Beaver Builder Addons by WPZOOM \<= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget (CVSS 6.4)
- [CVE-2024-2185](https://cve.now/CVE-2024-2185.md): Beaver Builder Addons by WPZOOM \<= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget (CVSS 6.4)
- [CVE-2024-2187](https://cve.now/CVE-2024-2187.md): Beaver Builder Addons by WPZOOM \<= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget (CVSS 6.4)
- [CVE-2024-22162](https://cve.now/CVE-2024-22162.md): WordPress WPZOOM Shortcodes Plugin \<= 1.0.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wpzoom
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.