shapedplugin vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20245
3. 20251
4. 20266

Newest CVEs

• CVE-2026-119160

  Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block

  shapedplugin · Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News

  Medium6.4
• CVE-2026-18988

  Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute

  shapedplugin · Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ

  Medium6.4
• CVE-2026-15652

  Easy Accordion <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block Attribute

  shapedplugin · Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ

  Medium6.4
• CVE-2026-7249

  Location Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging

  shapedplugin · Location Weather – WordPress Weather Forecast, AQI, Temperature and Weather Widget

  Medium4.3
• CVE-2026-4665

  WP Carousel Free <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute

  shapedplugin · Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel

  Medium6.4
• CVE-2026-3017

  Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object Injection

  shapedplugin · Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts

  High7.2
• CVE-2025-12584

  Quick View for WooCommerce <= 2.2.17 - Unauthenticated Private Product Disclosure

  shapedplugin · Quick View for WooCommerce

  Medium5.3
• CVE-2024-5020

  Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library

  extendthemes · Colibri Page Builder

  Medium6.4
• CVE-2024-32801

  WordPress Widget Post Slider plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

  ShapedPlugin · Widget Post Slider

  Medium5.9
• CVE-2024-3020

  Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Admin+) PHP Object Injection

  shapedplugin · Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel

  High7.2