CveMateVulnerability intelligence

Wpdeveloper vulnerabilities

157 vulnerabilities

Known vulnerabilities in Wpdeveloper products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 23 products.

Products

23

Essential Addons For Elementor59 vulnerabilities
Embedpress28 vulnerabilities
Essential Blocks25 vulnerabilities
Essential Blocks For Gutenberg8 vulnerabilities
Reviewx8 vulnerabilities
Betterdocs6 vulnerabilities
Templately6 vulnerabilities
Notificationx5 vulnerabilities
Simple 301 Redirects5 vulnerabilities
Betterlinks3 vulnerabilities
Essential Addons For Elementor Pro2 vulnerabilities
Twitter Cards Meta2 vulnerabilities
Typing Text2 vulnerabilities
Better Payment – Instant Payments, Donations, Fundraising With Subscriptions &Amp; More1 vulnerabilities
Countdown Block1 vulnerabilities
Document Block – Upload & Embed Docs1 vulnerabilities
Essential Blocks Pro1 vulnerabilities
Parallax Slider Block1 vulnerabilities
Reviewx – Multi Criteria Rating & Reviews For Woocommerce1 vulnerabilities
Schedulepress1 vulnerabilities
Secret Meta1 vulnerabilities
Simple 301 Redirects By Betterlinks1 vulnerabilities
Table Of Contents Block1 vulnerabilities

CVE-2021-4446wordpressessential-addons-for-elementor-lite+22y ago16-10-2024 06:43

The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to missing capability checks and nonce disclosure. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to perform many unauthorized actions such as changing settings and installing arbitrary plugins.CVE-2021-4447wordpressessential-addons-for-elementor-lite+22y ago16-10-2024 06:43

The Essential Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to a lack of restrictions on who can add a registration form and a custom registration role to an Elementor created page. This makes it possible for attackers with access to the Elementor page builder to create a new registration form that defaults to the user role being set to administrator and subsequently register as an administrative user.CVE-2021-24812unknownbetterlinks – shorten, track and manage any url+24y ago23-11-2021 19:16

The BetterLinks WordPress plugin before 1.2.6 does not sanitise and escape some of imported link fields, which could lead to Stored Cross-Site Scripting issues when an admin import a malicious CSV.CVE-2021-24353unknownsimple 301 redirects by betterlinks+25y ago14-06-2021 13:37

The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects.CVE-2021-24633unknowncountdown block+25y ago27-09-2021 15:25

The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authenticated user, such as Subscriber, to modify post contents displayed to users.CVE-2021-24354unknownsimple 301 redirects by betterlinks+25y ago14-06-2021 13:37

A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, made it possible for authenticated users to install arbitrary plugins on vulnerable sites.CVE-2021-24255unknownessential addons for elementor+25y ago05-05-2021 18:28

The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, both via a similar method.CVE-2021-24352unknownsimple 301 redirects by betterlinks+25y ago14-06-2021 13:37

The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to export a site's redirects.CVE-2021-24356unknownsimple 301 redirects by betterlinks+25y ago14-06-2021 13:37

In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple301redirects/admin/activate_plugin, made it possible for authenticated users to activate arbitrary plugins installed on vulnerable sites.CVE-2021-24355unknownsimple 301 redirects by betterlinks+25y ago14-06-2021 13:37

In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, the lack of capability checks and insufficient nonce check on the AJAX actions, simple301redirects/admin/get_wildcard and simple301redirects/admin/wildcard, made it possible for authenticated users to retrieve and update the wildcard value for redirects.CVE-2025-1664wordpressessential-blocks+21y ago08-03-2025 11:16

The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Parallax slider in all versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-26871wordpressessential-blocks+21y ago25-02-2025 14:17

Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.8.3.CVE-2025-39589wordpressessential-addons-for-elementor-lite+11y ago16-04-2025 12:44

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Retrieve Embedded Sensitive Data.This issue affects Essential Addons for Elementor: from n/a through <= 6.1.9.CVE-2025-39590wordpressessential-addons-for-elementor-lite+11y ago16-04-2025 12:44

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.1.9.CVE-2025-25086wordpressfacebook-secret-meta+11y ago27-03-2025 14:08

Cross-Site Request Forgery (CSRF) vulnerability in WPDeveloper Secret Meta facebook-secret-meta allows Reflected XSS.This issue affects Secret Meta: from n/a through <= 1.2.1.CVE-2025-22315wordpresstyping-text+11y ago07-01-2025 10:48

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Typing Text typing-text allows Stored XSS.This issue affects Typing Text: from n/a through <= 1.2.7.CVE-2025-22696wordpressdocument+11y ago04-02-2025 14:21

Missing Authorization vulnerability in WPDeveloper Document Block – Upload & Embed Docs document.This issue affects Document Block – Upload & Embed Docs: from n/a through <= 1.1.0.CVE-2025-22683wordpressnotificationx+11y ago03-02-2025 14:23

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper NotificationX notificationx allows Stored XSS.This issue affects NotificationX: from n/a through <= 2.9.5.CVE-2025-69092wordpressessential-addons-for-elementor-lite+19mo ago30-12-2025 10:47

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows DOM-Based XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.5.3.CVE-2025-24752wordpressessential-addons-for-elementor-lite+11y ago17-04-2025 15:48

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Reflected XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.0.14.