Vulnerabilities in stellarwp

134 results
Vexday analysis

Com 81 CVEs catalogadas, o portfólio da StellarWP apresenta concentração notável em CWE-79 (Cross-Site Scripting) como tipo de falha mais recorrente, o que é característico de ecossistemas voltados a plugins e temas para plataformas web. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma CVE confirmada em uso por atacantes no momento, embora isso não elimine o risco operacional. O ponto de maior atenção é CVE-2024-5932, com score EPSS de 0,74 — valor elevado que indica probabilidade significativa de exploração —, devendo ser tratada com prioridade independentemente de ainda não constar no KEV. A presença de 7 vulnerabilidades críticas e 4 com PoC pública reforça a necessidade de ciclos de patching ágeis para quem mantém produtos StellarWP em produção.

CVE-2025-48246MEDIUMWordPress The Events Calendar plugin <= 6.11.2.1 - Broken Access Control VulnerabilityEPSS 0.4%CVE-2024-31432MEDIUMWordPress Restrict Content plugin <= 3.2.8 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-14987MEDIUMGiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template SettingEPSS 0.4%CVE-2024-27987HIGHWordPress Give plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-3585HIGHThe Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_importEPSS 0.4%CVE-2026-1321HIGHMembership Plugin – Restrict Content <= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp_level'EPSS 0.4%CVE-2025-9807HIGHThe Events Calendar <= 6.15.1 - Unauthenticated SQL InjectionEPSS 0.3%CVE-2024-2919MEDIUMGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via CountUp WidgetEPSS 0.3%CVE-2024-6551MEDIUMGiveWP <= 3.15.1 - Unauthenticated Full Path DisclosureEPSS 0.3%CVE-2026-2633MEDIUMGutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media UploadEPSS 0.3%CVE-2024-4481MEDIUMGutenberg Blocks with AI by Kadence WP <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block LinkEPSS 0.3%CVE-2024-24888MEDIUMWordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.2.25 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2024-35679HIGHWordPress GiveWP plugin <= 3.12.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22633MEDIUMWordPress Give – Divi Donation Modules plugin <= 2.0.0 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2024-13457MEDIUMEvent Tickets <= 5.18.1 - Insecure Direct Object Reference to Sensitive Information ExposureEPSS 0.3%CVE-2024-5289MEDIUMGutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps WidgetEPSS 0.3%CVE-2026-11357MEDIUMKadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData LocalizationEPSS 0.3%CVE-2024-2273MEDIUMGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-49906MEDIUMWordPress WPComplete plugin <= 2.9.5.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-1304MEDIUMMembership Plugin – Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice SettingsEPSS 0.3%