CveMateVulnerability intelligence

Wpwax vulnerabilities

52 vulnerabilities

Known vulnerabilities in Wpwax products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 19 products.

Products

18 of 19

Directorist18 vulnerabilities
Legal Pages5 vulnerabilities
Post Grid\, Slider \& Carousel Ultimate5 vulnerabilities
Product Carousel Slider \& Grid Ultimate For Woocommerce4 vulnerabilities
Post Grid, Slider & Carousel Ultimate – With Shortcode, Gutenberg Block & Elementor Widget3 vulnerabilities
Formgent2 vulnerabilities
Formgent – Next Gen AI Form Builder For Wordpress With Multi Step, Quizzes, Payments & More2 vulnerabilities
Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid2 vulnerabilities
Team2 vulnerabilities
Team (Wordpress Plugin)2 vulnerabilities
Directorist – Wordpress Business Directory Plugin With Classified Ads Listings1 vulnerabilities
Directorist Addonskit For Elementor1 vulnerabilities
Directorist Booking1 vulnerabilities
Helpgent1 vulnerabilities
Legal Pages – Privacy Policy, Terms & Conditions, Gdpr, Ccpa, And Cookie Notice Generator1 vulnerabilities
Logo Carousel Slider1 vulnerabilities
Logo Showcase Ultimate1 vulnerabilities
Templatiq1 vulnerabilities

CVE-2026-17092wordpressdirectorist+18d ago14-10-2026 01:27

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary business directory listings, including those owned by other users and posts in publish, draft, or private status. The nonces guarding the endpoint do not constitute an authorization barrier because both directorist_nonce and atbdp_nonce_js are exposed to all logged-in users via wp_localize_script.CVE-2026-100185wordpressdirectorist+18d ago14-10-2026 03:40

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role, allowing any subscriber-level user to submit and publish listings without moderation.CVE-2021-24981unknowndirectorist – business directory plugin+24y ago21-12-2021 08:45

The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory.CVE-2025-2224wordpressdirectorist+11y ago25-03-2025 05:22

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'parse_query' function in all versions up to, and including, 8.2. This makes it possible for unauthenticated attackers to update the post_status of any post to 'publish'.CVE-2025-1570wordpressdirectorist+21y ago28-02-2025 08:23

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 8.1. This is due to the directorist_generate_password_reset_pin_code() and reset_user_password() functions not having enough controls to prevent a successful brute force attack of the OTP to change a password, or verify that a password reset request came from an authorized user. This makes it possible for unauthenticated attackers to generate and brute force an OTP that makes it possible to change any users passwords, including an administrator.CVE-2025-68069wordpressdirectorist+18mo ago20-02-2026 15:46

Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.6.6.CVE-2025-48242wordpresslegal-pages+11y ago19-05-2025 14:44

Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Legal Pages: from n/a through <= 1.4.5.CVE-2025-31857wordpressaddonskit-for-elementor+11y ago01-04-2025 14:52

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist AddonsKit for Elementor addonskit-for-elementor allows Stored XSS.This issue affects Directorist AddonsKit for Elementor: from n/a through <= 1.1.6.CVE-2025-39525wordpresslogo-carousel-slider+11y ago16-04-2025 12:45

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Logo Carousel Slider logo-carousel-slider allows Stored XSS.This issue affects Logo Carousel Slider: from n/a through <= 2.1.3.CVE-2025-66077wordpresslegal-pages+111mo ago21-11-2025 12:29

Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Legal Pages: from n/a through <= 1.4.6.CVE-2025-10488wordpressdirectorist+112mo ago25-10-2025 06:49

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to arbitrary file move due to insufficient file path validation in the add_listing_action AJAX action in all versions up to, and including, 8.4.8. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).CVE-2025-24782wordpresspost-grid-carousel-ultimate+11y ago27-01-2025 14:22

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Post Grid, Slider & Carousel Ultimate post-grid-carousel-ultimate allows PHP Local File Inclusion.This issue affects Post Grid, Slider & Carousel Ultimate: from n/a through <= 1.6.10.CVE-2025-24681wordpresswoo-product-carousel-slider-and-grid-ultimate+11y ago24-01-2025 17:24

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Product Carousel Slider & Grid Ultimate for WooCommerce woo-product-carousel-slider-and-grid-ultimate allows Stored XSS.This issue affects Product Carousel Slider & Grid Ultimate for WooCommerce: from n/a through <= 1.10.0.CVE-2025-64250wordpressdirectorist+110mo ago16-12-2025 08:12

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wpWax Directorist directorist allows Phishing.This issue affects Directorist: from n/a through <= 8.6.6.CVE-2025-15028wordpressformgent+12mo ago06-08-2026 11:29

The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-32658wordpresshelpgent+11y ago17-04-2025 15:47

Deserialization of Untrusted Data vulnerability in wpWax HelpGent helpgent allows Object Injection.This issue affects HelpGent: from n/a through <= 2.2.5.CVE-2025-32499wordpresslogo-showcase-ultimate+11y ago09-04-2025 16:09

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Logo Showcase Ultimate logo-showcase-ultimate allows PHP Local File Inclusion.This issue affects Logo Showcase Ultimate: from n/a through <= 1.4.4.CVE-2025-12174wordpressdirectorist+111mo ago19-11-2025 05:45

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'directorist_prepare_listings_export_file' and 'directorist_type_slug_change' AJAX actions in all versions up to, and including, 8.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export listing details and change the directorist slug.CVE-2022-2377unknowndirectorist – wordpress business directory plugin with classified ads listings+24y ago22-08-2022 15:02

The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog CVE-2022-2376unknowndirectorist – wordpress business directory plugin with classified ads listings+24y ago05-09-2022 12:35

The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users