Vulnerabilidades en StellarWP
127 resultadosAnálisis Vexday
StellarWP apresenta 36 vulnerabilidades catalogadas, das quais apenas 2 são críticas e nenhuma está sob ataque ativo conhecido, indicando risco contido no curto prazo. A fraqueza dominante (CWE-862 - falta de autorização) sugere problemas estruturais em controle de acesso que demandam revisão. O ritmo de publicações é baixo (2 nos últimos 90 dias), refletindo uma superfície de exposição estável.
CVE-2026-13704MEDIUMGiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa FormEPSS 0.2%CVE-2026-2694MEDIUMThe Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST APIEPSS 0.2%CVE-2025-12175MEDIUMThe Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code ExposureEPSS 0.2%CVE-2025-5144MEDIUMThe Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-32546HIGHWordPress Restrict Content plugin <= 3.2.22 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2024-47315MEDIUMWordPress GiveWP – Donation Plugin and Fundraising Platform plugin <= 3.15.1 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2025-14000MEDIUMMembership Plugin – Restrict Content <= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodesEPSS 0.2%CVE-2026-14987MEDIUMGiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template SettingEPSS 0.2%CVE-2026-18062MEDIUMKadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image ContentEPSS 0.2%CVE-2024-31433MEDIUMWordPress The Events Calendar plugin <= 6.3.0 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2025-62027MEDIUMWordPress Event Tickets plugin <= 5.26.3 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-4136MEDIUMMembership Plugin – Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirectEPSS 0.2%CVE-2026-2608MEDIUMGutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing AuthorizationEPSS 0.2%CVE-2025-7205MEDIUMGiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-50046MEDIUMWordPress WPComplete plugin <= 2.9.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58974MEDIUMWordPress WPComplete Plugin <= 2.9.5.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2024-38762MEDIUMWordPress Event Tickets and Registration plugin <= 5.11.0.4 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2024-37518MEDIUMWordPress The Events Calendar plugin <= 6.5.1.4 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2026-18435MEDIUMKadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block AttributeEPSS 0.2%CVE-2026-42642MEDIUMWordPress GiveWP plugin <= 4.14.5 - Broken Access Control vulnerabilityEPSS 0.2%