Qode Interactive vulnerabilities

Products

• Qi Addons For Elementor 2
• Bridge Core 1
• Qode Essential Addons 1
• Tiare Membership 1

Latest Qode Interactive CVEs

Newest publication first

1. CVE-2025-13540 Tiare Membership <= 1.2 - Unauthenticated Privilege Escalation

   Published 2025-11-27

   Critical·CVSS 9.8

   The Tiare Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. This is due to the 'tiare_membership_init_rest_api_register' function not restricting what user roles a user can register with. This makes it possible for un...

2. CVE-2023-47679 WordPress Qi Addons For Elementor plugin <= 1.6.3 - Local File Inclusion vulnerability

   Published 2024-05-17

   High·CVSS 8.8

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in QODE Interactive Qi Addons For Elementor allows PHP Local File Inclusion.This issue affects Qi Addons For Elementor: from n/a through 1.6.3.

3. CVE-2023-47840 WordPress Qode Essential Addons Plugin <= 1.5.2 is vulnerable to Remote Code Execution (RCE)

   Published 2023-12-29

   High·CVSS 8.8

   Improper Control of Generation of Code ('Code Injection') vulnerability in Qode Interactive Qode Essential Addons.This issue affects Qode Essential Addons: from n/a through 1.5.2.

4. CVE-2023-47680 WordPress Qi Addons For Elementor Plugin <= 1.6.3 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-11-13

   Medium·CVSS 5.4

   Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Qode Interactive Qi Addons For Elementor plugin <= 1.6.3 versions.

5. CVE-2023-40333 WordPress Bridge Core Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-09-27

   Medium·CVSS 6.1

   Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Qode Interactive Bridge Core plugin <= 3.0.9 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.