Pickplugins vulnerabilities
89 vulnerabilities
Known vulnerabilities in Pickplugins products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 29 products.
Products
29- Post Grid24 vulnerabilities
- Job Board Manager9 vulnerabilities
- Post Grid And Gutenberg Blocks8 vulnerabilities
- Team Showcase7 vulnerabilities
- Accordion6 vulnerabilities
- Wishlist6 vulnerabilities
- Product Slider For Woocommerce5 vulnerabilities
- Comboblocks4 vulnerabilities
- Post Grid Combo3 vulnerabilities
- Question Answer3 vulnerabilities
- Testimonial Slider3 vulnerabilities
- Accordions2 vulnerabilities
- Mail Picker2 vulnerabilities
- Pickplugins Product Designer For Woocommerce2 vulnerabilities
- Product Designer2 vulnerabilities
- User Verification2 vulnerabilities
- User Verification By Pickplugins2 vulnerabilities
- Breadcrumb1 vulnerabilities
- Pickplugins Pricing Table1 vulnerabilities
- Pickplugins Product Slider For Woocommerce1 vulnerabilities
- Pickplugins Question Answer1 vulnerabilities
- Post Grid And Gutenberg Blocks – Comboblocks1 vulnerabilities
- Post Grid Combo – 36+ Gutenberg Blocks1 vulnerabilities
- Pricing Table1 vulnerabilities
- Related Post1 vulnerabilities
- Related Posts By Pickplugins1 vulnerabilities
- Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By Pickplugins1 vulnerabilities
- Tabs & Accordion1 vulnerabilities
- User Profile1 vulnerabilities
HighCVE-2021-4450pickplugins · post_grid +1 morePost Grid <= 2.1.12 - Contributor+ SQL InjectionThe Post Grid plugin for WordPress is vulnerable to blind SQL Injection via post metadata in versions up to, and including, 2.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level permissions and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.EPSS0.49%MediumCVE-2021-24283pickplugins · accordion +1 moreAccordion < 2.2.30 - Authenticated Reflected Cross-Site Scripting (XSS)The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.EPSS0.62%MediumCVE-2021-24986pickplugins · post_grid +2 morePost Grid < 2.1.16 - Reflected Cross-Site Scripting via keywordThe Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search formEPSS0.80%MediumCVE-2021-24488pickplugins · post_grid +2 morePost Grid < 2.1.8 - Reflected Cross-Site Scripting (XSS)The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issuesEPSS11.24%MediumCVE-2021-24300pickplugins · pickplugins product slider for woocommerce +2 morePickPlugins Product Slider for WooCommerce < 1.13.22 - Reflected Cross-Site Scripting (XSS)The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issueEPSS10.59%MediumCVE-2025-63043pickplugins · post grid and gutenberg blocks +1 moreWordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Insecure Direct Object References (IDOR) vulnerabilityAuthorization Bypass Through User-Controlled Key vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.23.EPSS0.24%HighCVE-2025-54007pickplugins · post grid and gutenberg blocks +1 moreWordPress Post Grid and Gutenberg Blocks Plugin <= 2.3.11 - PHP Object Injection VulnerabilityDeserialization of Untrusted Data vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Object Injection.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.11.EPSS0.43%MediumCVE-2025-62924pickplugins · post grid and gutenberg blocks +1 moreWordPress Post Grid and Gutenberg Blocks plugin <= 2.3.17 - Broken Access Control vulnerabilityMissing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.17.EPSS0.33%MediumCVE-2025-62929pickplugins · testimonial slider +1 moreWordPress Testimonial Slider plugin <= 2.0.15 - Broken Access Control vulnerabilityMissing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonial Slider: from n/a through <= 2.0.15.EPSS0.33%MediumCVE-2025-62745pickplugins · team_showcase +1 moreWordPress Team Showcase plugin <= 1.22.28 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Team Showcase allows Stored XSS.
This issue affects Team Showcase: from n/a through 1.22.28.EPSS0.17%MediumCVE-2025-68605pickplugins · post grid and gutenberg blocks +1 moreWordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Stored XSS.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.23.EPSS0.16%MediumCVE-2025-68000pickplugins · testimonial slider +1 moreWordPress Testimonial Slider plugin <= 2.0.15 - Broken Access Control vulnerabilityMissing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonial Slider: from n/a through <= 2.0.15.EPSS0.35%HighCVE-2025-26915pickplugins · wishlist +1 moreWordPress Wishlist Plugin <= 1.0.41 - SQL Injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist wishlist allows SQL Injection.This issue affects Wishlist: from n/a through <= 1.0.41.EPSS0.42%MediumCVE-2025-31862pickplugins · job board manager +1 moreWordPress Job Board Manager Plugin <= 2.1.61 - Broken Access Control vulnerabilityMissing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Job Board Manager: from n/a through <= 2.1.61.EPSS0.34%MediumCVE-2025-31810pickplugins · question answer +1 moreWordPress Question Answer plugin <= 1.2.73 - Broken Access Control vulnerabilityMissing Authorization vulnerability in PickPlugins Question Answer question-answer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Question Answer: from n/a through <= 1.2.73.EPSS0.45%MediumCVE-2025-53421pickplugins · accordion +1 moreWordPress Accordion plugin <= 2.3.14 - Broken Access Control vulnerabilityMissing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.14.EPSS0.32%MediumCVE-2025-66058pickplugins · post grid and gutenberg blocks +1 moreWordPress Post Grid and Gutenberg Blocks plugin <= 2.3.17 - Broken Access Control vulnerabilityMissing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.17.EPSS0.24%MediumCVE-2025-58678pickplugins · accordion +1 moreWordPress Accordion Plugin <= 2.3.15 - Broken Access Control VulnerabilityMissing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.15.EPSS0.32%MediumCVE-2025-58827pickplugins · job board manager +1 moreWordPress Job Board Manager Plugin <= 2.1.61 - Content Injection VulnerabilityImproper Control of Generation of Code ('Code Injection') vulnerability in PickPlugins Job Board Manager job-board-manager allows Code Injection.This issue affects Job Board Manager: from n/a through <= 2.1.61.EPSS0.25%HighCVE-2025-22679pickplugins · job board manager +1 moreWordPress Job Board Manager Plugin <= 2.1.61 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager job-board-manager allows Reflected XSS.This issue affects Job Board Manager: from n/a through <= 2.1.61.EPSS0.32%