WP Grids vulnerabilities

Products

• EasyTest – Simplify A/B Testing 2
• WP Wand 2
• Slicko 1

Latest WP Grids CVEs

Newest publication first

1. CVE-2026-68567 WordPress EasyTest – Simplify A/B Testing plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

   Published 2026-08-18

   High·CVSS 7.1 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows DOM-Based XSS.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1.

2. CVE-2026-25391 WordPress WP Wand plugin <= 1.3.07 - Broken Access Control vulnerability

   Published 2026-02-19

   Medium·CVSS 5.4 EPSS 0.24%

   Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Wand: from n/a through <= 1.3.07.

3. CVE-2025-63031 WordPress EasyTest – Simplify A/B Testing plugin <= 1.0.1 - Broken Access Control vulnerability

   Published 2025-12-31

   Medium·CVSS 5.3 EPSS 0.21%

   Missing Authorization vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1.

4. CVE-2025-22302 WordPress WP Wand plugin <= 1.2.5 - Broken Access Control vulnerability

   Published 2025-01-07

   Medium·CVSS 5.3 EPSS 0.34%

   Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Wand: from n/a through <= 1.2.5.

5. CVE-2024-51591 WordPress Slicko plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

   Published 2024-11-09

   Medium·CVSS 5.4 EPSS 0.27%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids Slicko slicko-for-elementor allows DOM-Based XSS.This issue affects Slicko: from n/a through <= 1.2.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.