CveMateVulnerability intelligence

Shapedplugin vulnerabilities

26 vulnerabilities

Known vulnerabilities in Shapedplugin products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 15 products.

Products

15

Wp Tabs5 vulnerabilities
Carousel, Slider, Photo Gallery With Lightbox, Video Slider, By WP Carousel4 vulnerabilities
Product Slider For Woocommerce3 vulnerabilities
Smart Post Show3 vulnerabilities
Easy Accordion – AI Powered FAQ & Accordion Blocks, Product FAQ2 vulnerabilities
Logo Carousel2 vulnerabilities
Easy Accordion – Responsive Accordion FAQ Builder And Product FAQ1 vulnerabilities
Location Weather1 vulnerabilities
Location Weather – Wordpress Weather Forecast, AQI, Temperature And Weather Widget1 vulnerabilities
Quick View For Woocommerce1 vulnerabilities
Real Testimonials1 vulnerabilities
Smart Post Show – Post Grid, Post Carousel & Slider, And List Category Posts1 vulnerabilities
Widget Post Slider1 vulnerabilities
Wp Carousel1 vulnerabilities
WP Tabs – Responsive Tabs Plugin For Wordpress1 vulnerabilities

CVE-2021-24739shapedpluginlogo_carousel+24y ago21-12-2021 08:45

The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature CVE-2021-24738shapedpluginlogo_carousel+24y ago21-12-2021 08:45

The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks CVE-2025-48134shapedplugin llcwp tabs+21y ago16-05-2025 15:45

Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC WP Tabs wp-expand-tabs-free allows Object Injection.This issue affects WP Tabs: from n/a through <= 2.2.12.CVE-2025-12584shapedpluginquick view for woocommerce+110mo ago27-11-2025 09:27

The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqv_popup_content' AJAX endpoint due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from private products that they should not have access to.CVE-2022-2382shapedpluginproduct_slider_for_woocommerce+24y ago22-08-2022 15:02

The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options.CVE-2022-4648shapedpluginreal_testimonials+23y ago16-01-2023 15:37

The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.CVE-2022-4629shapedpluginproduct_slider_for_woocommerce+23y ago23-01-2023 14:31

The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.CVE-2024-2949shapedplugincarousel, slider, photo gallery with lightbox, video slider, by wp carousel+22y ago06-04-2024 06:47

The Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the carousel widget in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-1363shapedplugineasy accordion – responsive accordion faq builder and product faq+22y ago13-03-2024 15:27

The Easy Accordion – Best Accordion FAQ Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordion_content_source' attribute in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-11503shapedpluginwp_tabs+21y ago25-03-2025 06:00

The WP Tabs WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).CVE-2024-502010webform maker by 10web – mobile-friendly drag & drop contact form builder+301y ago04-12-2024 08:22

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-32801shapedpluginwidget post slider+12y ago24-04-2024 08:44

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin Widget Post Slider allows Stored XSS.This issue affects Widget Post Slider: from n/a through 1.3.5.CVE-2024-8187shapedpluginsmart_post_show+21y ago15-05-2025 20:07

The Smart Post Show WordPress plugin before 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).CVE-2024-3996shapedpluginsmart_post_show+21y ago15-05-2025 20:09

The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)CVE-2024-3020shapedplugincarousel, slider, photo gallery with lightbox, video slider, by wp carousel+12y ago10-04-2024 04:30

The plugin is vulnerable to PHP Object Injection in versions up to and including, 2.6.3 via deserialization of untrusted input in the import function via the 'shortcode' parameter. This allows authenticated attackers, with administrator-level access to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.CVE-2026-4665shapedplugincarousel, slider, photo gallery with lightbox, video slider, by wp carousel+15mo ago05-05-2026 03:37

The WP Carousel Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted fancybox `data-caption` attributes in all versions up to, and including, 2.7.10. This is due to the `fancybox-config.js` script reading the carousel container's `id` attribute directly from the DOM to construct a jQuery selector without sanitization. When a Contributor crafts an HTML block with a malformed carousel container ID (containing characters invalid for jQuery selectors), the custom fancybox configuration throws a JavaScript error and fails to initialize. This causes the bundled fancybox library (v3.5.7) to fall back to its default caption handling, which renders the `data-caption` attribute content as raw HTML. Since WordPress allows `data-*` attributes through `wp_kses_post()`, this makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks an image in the crafted carousel lightbox.CVE-2026-7249shapedpluginlocation weather – wordpress weather forecast, aqi, temperature and weather widget+15mo ago22-05-2026 03:39

The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the `splw_update_block_options()` and `lwp_clean_weather_transients()` functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to disable all weather blocks and purge all weather cache transients. The nonce required for these actions is exposed to all authenticated users via `wp_localize_script()` on the `init` hook.CVE-2026-18988shapedplugineasy accordion – ai-powered faq & accordion blocks, product faq+12mo ago08-08-2026 04:25

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordion_header_renderer() function, which emits the attacker-supplied tag name using esc_attr() in an HTML tag-name context instead of tag_escape(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2026-15652shapedplugineasy accordion – ai-powered faq & accordion blocks, product faq+13mo ago16-07-2026 02:30

The Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'align' Block Attribute in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2026-3017shapedpluginsmart post show – post grid, post carousel & slider, and list category posts+16mo ago14-04-2026 05:30

The Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.12 via deserialization of untrusted input in the import_shortcodes() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.