WPDeveloper Vulnerabilities and Affected Products
Explore source-attributed vulnerabilities associated with WPDeveloper products.
Products
- Essential Addons for Elementor11 vulnerabilities
- EmbedPress9 vulnerabilities
- Essential Blocks for Gutenberg8 vulnerabilities
- BetterDocs6 vulnerabilities
- essential_addons_for_elementor5 vulnerabilities
- Templately5 vulnerabilities
- NotificationX3 vulnerabilities
- BetterLinks2 vulnerabilities
- Essential Addons for Elementor Pro2 vulnerabilities
- essential_blocks2 vulnerabilities
- SchedulePress2 vulnerabilities
- Typing Text2 vulnerabilities
- Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More1 vulnerability
- Document Block – Upload & Embed Docs1 vulnerability
- Essential Addons for Elementor plugin for WordPress1 vulnerability
- Parallax Slider Block1 vulnerability
- ReviewX – Multi-criteria Rating & Reviews for WooCommerce1 vulnerability
- Secret Meta1 vulnerability
- Simple 301 Redirects by BetterLinks1 vulnerability
- simple_301_redirects1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-61961HIGH | WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerabilityUnauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions. CWE-79Aug 6, 2026 | CVSS7.1v3.1 | EPSS0.18% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-65562MEDIUM | WordPress BetterDocs plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerabilityContributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions. CWE-79Jul 27, 2026 | CVSS6.5v3.1 | EPSS0.13% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-57364MEDIUM | WordPress Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More plugin <= 2.2.0 - Other Vulnerability Type vulnerabilityImproper Validation of Specified Quantity in Input vulnerability in WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More better-payment allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More: from n/a through <= 2.2.0. CWE-1284Jul 13, 2026 | CVSS6.5v3.1 | EPSS0.248% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-48872HIGH | WordPress EmbedPress plugin <= 4.5.2 - Sensitive Data Exposure vulnerabilityUnauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions. CWE-639Jun 15, 2026 | CVSS7.5v3.1 | EPSS0.346% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-25440MEDIUM | WordPress Essential Addons for Elementor plugin < 6.6.0 - Broken Access Control vulnerabilityUnauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions. CWE-862Jun 15, 2026 | CVSS5.3v3.1 | EPSS0.214% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-42644MEDIUM | WordPress BetterDocs plugin <= 4.3.10 - Sensitive Data Exposure vulnerabilityExposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper BetterDocs betterdocs allows Retrieve Embedded Sensitive Data.This issue affects BetterDocs: from n/a through <= 4.3.10. CWE-497Apr 29, 2026 | CVSS5.3v3.1 | EPSS0.247% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-42379HIGH | WordPress Templately plugin <= 3.6.1 - Sensitive Data Exposure vulnerabilityInsertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data.This issue affects Templately: from n/a through 3.6.1. CWE-201Apr 27, 2026 | CVSS7.7v3.1 | EPSS0.212% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-27042MEDIUM | WordPress NotificationX plugin <= 3.2.1 - Broken Access Control vulnerabilityMissing Authorization vulnerability in WPDeveloper NotificationX notificationx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NotificationX: from n/a through <= 3.2.1. CWE-862Feb 19, 2026 | CVSS5.3v3.1 | EPSS0.176% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-23543MEDIUM | WordPress Essential Addons for Elementor plugin <= 6.5.5 - Broken Access Control vulnerabilityMissing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Addons for Elementor: from n/a through <= 6.5.5. CWE-862Feb 19, 2026 | CVSS5.3v3.1 | EPSS0.228% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-69092MEDIUM | WordPress Essential Addons for Elementor plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows DOM-Based XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.5.3. CWE-79Dec 30, 2025 | CVSS6.5v3.1 | EPSS0.132% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
WordPress Essential Addons for Elementor plugin <= 6.2.4 - Broken Access Control vulnerabilityMissing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Addons for Elementor: from n/a through <= 6.2.4. CWE-862Oct 31, 2025 | CVSS2.7v3.1 | EPSS0.213% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2025-49408CRITICAL | WordPress Templately Plugin <= 3.2.7 - Sensitive Data Exposure VulnerabilityInsertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data. This issue affects Templately: from n/a through 3.2.7. | CVSS10.0v3.1 | EPSS0.493% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-24752HIGH | WordPress Essential Addons for Elementor plugin <= 6.0.14 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Reflected XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.0.14. | CVSS7.1v3.1 | EPSS1.2% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2025-39589MEDIUM | WordPress Essential Addons for Elementor plugin <= 6.1.9 - Sensitive Data Exposure VulnerabilityExposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Retrieve Embedded Sensitive Data.This issue affects Essential Addons for Elementor: from n/a through <= 6.1.9. CWE-497Apr 16, 2025 | CVSS4.3v3.1 | EPSS0.39% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-39590MEDIUM | WordPress Essential Addons for Elementor plugin <= 6.1.9 - Cross Site Scripting (XSS) VulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.1.9. CWE-79Apr 16, 2025 | CVSS6.5v3.1 | EPSS0.301% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-25086HIGH | WordPress Secret Meta plugin <= 1.2.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in WPDeveloper Secret Meta facebook-secret-meta allows Reflected XSS.This issue affects Secret Meta: from n/a through <= 1.2.1. CWE-352Mar 27, 2025 | CVSS7.1v3.1 | EPSS0.131% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-26871MEDIUM | WordPress Essential Blocks plugin <= 4.8.3 - Broken Access Control vulnerabilityMissing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.8.3. CWE-862Feb 25, 2025 | CVSS4.3v3.1 | EPSS0.391% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-22696MEDIUM | WordPress Document Block – Upload & Embed Docs, PDF, PPT, XLS or Any Documents plugin <= 1.1.0 - Broken Access Control vulnerabilityMissing Authorization vulnerability in WPDeveloper Document Block – Upload & Embed Docs document.This issue affects Document Block – Upload & Embed Docs: from n/a through <= 1.1.0. CWE-862Feb 4, 2025 | CVSS5.4v3.1 | EPSS0.284% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-22683MEDIUM | WordPress NotificationX plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper NotificationX notificationx allows Stored XSS.This issue affects NotificationX: from n/a through <= 2.9.5. CWE-79Feb 3, 2025 | CVSS6.5v3.1 | EPSS0.309% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-22315MEDIUM | WordPress Typing Text plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Typing Text typing-text allows Stored XSS.This issue affects Typing Text: from n/a through <= 1.2.7. CWE-79Jan 7, 2025 | CVSS6.5v3.1 | EPSS0.296% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-45104HIGH | WordPress BetterLinks plugin <= 1.6.0 - Broken Access Control vulnerabilityMissing Authorization vulnerability in WPDeveloper BetterLinks betterlinks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BetterLinks: from n/a through <= 1.6.0. CWE-862Jan 2, 2025 | CVSS7.3v3.1 | EPSS0.362% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-56063MEDIUM | WordPress Essential Addons for Elementor plugin <= 6.0.7 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.0.7. CWE-79Dec 31, 2024 | CVSS6.5v3.1 | EPSS0.248% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-47594MEDIUM | WordPress Essential Blocks for Gutenberg plugin <= 3.8.5 - Broken Access ControlMissing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through 3.8.5. CWE-862Dec 13, 2024 | CVSS6.5v3.1 | EPSS0.419% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-47760MEDIUM | WordPress Essential Blocks plugin <= 4.2.0 - Broken Access Control vulnerabilityMissing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0. CWE-862Dec 9, 2024 | CVSS4.3v3.1 | EPSS0.393% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-47761MEDIUM | WordPress Simple 301 Redirects by BetterLinks plugin <= 2.0.7 - Broken Access Control vulnerabilityMissing Authorization vulnerability in WPDeveloper Simple 301 Redirects by BetterLinks simple-301-redirects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple 301 Redirects by BetterLinks: from n/a through <= 2.0.7. CWE-862Dec 9, 2024 | CVSS4.3v3.1 | EPSS0.328% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |