shapedplugin vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20245
3. 20251
4. 20269

Newest CVEs

• CVE-2026-120509

  Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter

  shapedplugin · Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials

  Medium4.7
• CVE-2026-120685

  Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chain

  shapedplugin · Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials

  Medium5.4
• CVE-2026-120683

  Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parameter

  shapedplugin · Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials

  Medium5.4
• CVE-2026-119160

  Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block

  shapedplugin · Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News

  Medium6.4
• CVE-2026-18988

  Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute

  shapedplugin · Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ

  Medium6.4
• CVE-2026-15652

  Easy Accordion <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block Attribute

  shapedplugin · Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ

  Medium6.4
• CVE-2026-7249

  Location Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging

  shapedplugin · Location Weather – WordPress Weather Forecast, AQI, Temperature and Weather Widget

  Medium4.3
• CVE-2026-4665

  WP Carousel Free <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute

  shapedplugin · Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel

  Medium6.4
• CVE-2026-3017

  Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object Injection

  shapedplugin · Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts

  High7.2
• CVE-2025-12584

  Quick View for WooCommerce <= 2.2.17 - Unauthenticated Private Product Disclosure

  shapedplugin · Quick View for WooCommerce

  Medium5.3