Plugin Devs vulnerabilities

Products

• Blog, Posts and Category Filter for Elementor 2
• Post Carousel Slider for Elementor 2
• News Ticker for Elementor 1
• Product Carousel Slider for Elementor 1
• Shopify to WooCommerce Migration 1

Latest Plugin Devs CVEs

Newest publication first

1. CVE-2026-40806 WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-06

   High·CVSS 7.1 EPSS 0.18%

   Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.

2. CVE-2025-57955 WordPress Post Carousel Slider for Elementor Plugin <= 1.7.0 - Broken Access Control Vulnerability

   Published 2025-09-22

   Medium·CVSS 6.5 EPSS 0.46%

   Missing Authorization vulnerability in Plugin Devs Post Carousel Slider for Elementor post-carousel-slider-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Carousel Slider for Elementor: from n/a through <= 1.7.0.

3. CVE-2025-58816 WordPress Product Carousel Slider for Elementor Plugin <= 2.1.3 - Broken Access Control Vulnerability

   Published 2025-09-05

   Low·CVSS 3.5 EPSS 0.25%

   Missing Authorization vulnerability in Plugin Devs Product Carousel Slider for Elementor ecommerce-product-carousel-slider-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Carousel Slider for Elementor: from n/a thro...

4. CVE-2025-31795 WordPress Shopify to WooCommerce Migration plugin <= 1.3.0 - Settings Change vulnerability

   Published 2025-04-03

   Medium·CVSS 6.5 EPSS 0.39%

   Missing Authorization vulnerability in Plugin Devs Shopify to WooCommerce Migration migrate-shopify-to-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shopify to WooCommerce Migration: from n/a through <= 1.3.0.

5. CVE-2025-22648 WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

   Published 2025-03-27

   Medium·CVSS 6.5 EPSS 0.26%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Devs Blog, Posts and Category Filter for Elementor blog-posts-and-category-for-elementor allows Stored XSS.This issue affects Blog, Posts and Category Filter for Elementor...

6. CVE-2024-54278 WordPress News Ticker for Elementor plugin <= 2.1.3 - Broken Access Control vulnerability

   Published 2024-12-13

   Medium·CVSS 4.3 EPSS 0.44%

   Missing Authorization vulnerability in Plugin Devs News Ticker for Elementor news-ticker-for-elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects News Ticker for Elementor: from n/a through <= 2.1.3.

7. CVE-2024-53749 WordPress Post Carousel Slider for Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

   Published 2024-12-01

   Medium·CVSS 6.5 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Devs Post Carousel Slider for Elementor post-carousel-slider-for-elementor allows Stored XSS.This issue affects Post Carousel Slider for Elementor: from n/a through <= 1.5...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.