stellarwp vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20233
3. 202450
4. 202544
5. 202639

Newest CVEs

• CVE-2026-118193

  GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter

  stellarwp · GiveWP – Donation Plugin and Fundraising Platform

  High8.8
• CVE-2026-97643

  GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes

  stellarwp · GiveWP – Donation Plugin and Fundraising Platform

  Medium6.4
• CVE-2026-104762

  Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute

  stellarwp · Kadence Blocks — Page Builder Toolkit for Gutenberg Editor

  Medium6.4
• CVE-2026-97634

  Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter

  stellarwp · Event Tickets and Registration

  Medium6.5
• CVE-2026-77820

  WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute

  stellarwp · WPComplete

  Medium6.4
• CVE-2026-78159

  The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation

  stellarwp · The Events Calendar

  Critical9.8
• CVE-2026-78006

  The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution

  stellarwp · The Events Calendar

  Critical9.8
• CVE-2026-3174

  Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update

  stellarwp · Event Tickets and Registration

  High7.5
• CVE-2026-12843

  LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint

  StellarWP · LearnDash LMS

  Medium5.4
• CVE-2026-12483

  LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler

  StellarWP · LearnDash LMS

  High7.5