Pickplugins vulnerabilities, page 5
89 vulnerabilities
Known vulnerabilities in Pickplugins products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 29 products.
MediumCVE-2026-10862pickplugins · accordions +1 moreAccordions <= 2.3.23 - Authenticated (Custom+) Stored Cross-Site Scripting via Accordion Body FieldThe Accordions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Accordion body field in all versions up to, and including, 2.3.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.15%HighCVE-2026-10207pickplugins · pickplugins question answer +1 morePickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' ParameterThe PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp_unslash() which removes WordPress's magic quotes protection, followed by direct concatenation into a SQL query without proper escaping or prepared statements in the qa_user_profile_card() function. This makes it possible for unauthenticated attackers to append additional SQL queries into existing queries, which can be used to extract sensitive information from the database.EPSS0.51%MediumCVE-2026-32497pickplugins · user_verification +1 moreWordPress User Verification plugin <= 2.0.45 - Email Verification Bypass vulnerabilityWeak Authentication vulnerability in PickPlugins User Verification user-verification allows Authentication Abuse.This issue affects User Verification: from n/a through <= 2.0.45.EPSS0.33%MediumCVE-2023-40557pickplugins · tabs & accordion +1 moreWordPress Tabs & Accordion plugin <= 1.3.10 - Content Injection vulnerabilityImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PickPlugins Tabs & Accordion allows Code Injection.This issue affects Tabs & Accordion: from n/a through 1.3.10.EPSS0.43%HighCVE-2023-40211pickplugins · post_grid_combo +2 moreWordPress Post Grid Plugin <= 2.2.50 is vulnerable to Sensitive Data ExposureExposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Combo – 36+ Gutenberg Blocks: from n/a through 2.2.50.EPSS2.16%MediumCVE-2023-51666pickplugins · related_post +1 moreWordPress Related Post Plugin <= 2.0.53 is vulnerable to Cross Site Scripting (XSS)Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Related Post allows Stored XSS.This issue affects Related Post: from n/a through 2.0.53.EPSS0.33%MediumCVE-2023-0166pickplugins · product_slider_for_woocommerce +2 morePickPlugins Product Slider for WooCommerce < 1.13.42 - Contributor+ Stored XSSThe Product Slider for WooCommerce by PickPlugins WordPress plugin before 1.13.42 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.EPSS0.48%HighCVE-2023-7072pickplugins · post_grid +2 morePost Grid Combo – 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_posts API EndpointThe Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.68 via the 'get_posts' REST API Endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including full draft posts and password protected posts, as well as the password for password-protected posts.EPSS0.62%MediumCVE-2023-6645pickplugins · post_grid +2 morePost Grid Combo – 36+ Gutenberg Blocks <= 2.2.64 - Authenticated (Contributor+) Cross-Site ScriptingThe Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in all versions up to, and including, 2.2.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.34%