QODE vulnerabilities

Products

• Qi Blocks 3
• Bridge Core 2
• Qode Tours 2
• Bridge - Creative Multipurpose WordPress Theme 1
• Qi Addons For Elementor 1
• Qode Essential Addons 1
• Qode Music 1
• Qode Real Estate 1

Latest QODE CVEs

Newest publication first

1. CVE-2026-42712 WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability

   Published 2026-10-10

   High·CVSS 8.5 EPSS 0.33%

   Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.

2. CVE-2026-42632 WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-10

   High·CVSS 7.1 EPSS 0.18%

   Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.

3. CVE-2026-42631 WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-10

   High·CVSS 7.1 EPSS 0.18%

   Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.

4. CVE-2026-62079 WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability

   Published 2026-09-30

   Medium·CVSS 6.5 EPSS 0.17%

   Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.

5. CVE-2026-15609 Bridge - Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute

   Published 2026-09-15

   Medium·CVSS 6.4 EPSS 0.26%

   The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it possi...

6. CVE-2026-65546 WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability

   Published 2026-08-06

   Critical·CVSS 9.3 EPSS 0.40%

   Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.

7. CVE-2025-64383 WordPress Qi Blocks plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability

   Published 2025-11-13

   Medium·CVSS 6.5 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Qode Qi Blocks qi-blocks allows Stored XSS.This issue affects Qi Blocks: from n/a through <= 1.4.3.

8. CVE-2024-50457 WordPress Qode Essential Addons plugin <= 1.6.3 - Local File Inclusion vulnerability

   Published 2024-10-28

   High·CVSS 8.8 EPSS 0.56%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Qode Qode Essential Addons qode-essential-addons.This issue affects Qode Essential Addons: from n/a through <= 1.6.3.

9. CVE-2024-49690 WordPress Qi Blocks plugin <= 1.3.2 - Local File Inclusion vulnerability

   Published 2024-10-23

   High·CVSS 8.8 EPSS 0.56%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Qode Qi Blocks qi-blocks.This issue affects Qi Blocks: from n/a through <= 1.3.2.

10. CVE-2024-9860 Bridge Core <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Demo Import

    Published 2024-10-12

    Medium·CVSS 5.4 EPSS 0.32%

    The Bridge Core plugin for WordPress is vulnerable to unauthorized modification of data or loss of data due to a missing capability check on the 'import_action' and 'install_plugin_per_demo' functions in versions up to, and including, 3.3. This makes it possible for authenticated...

11. CVE-2024-9292 Bridge Core <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    Published 2024-10-08

    Medium·CVSS 6.4 EPSS 0.29%

    The Bridge Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated at...

12. CVE-2024-38712 WordPress Qi Blocks plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability

    Published 2024-07-20

    Medium·CVSS 5.4 EPSS 0.26%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Qode Qi Blocks qi-blocks.This issue affects Qi Blocks: from n/a through <= 1.3.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.