WPDeveloper vulnerabilities

Products

• Essential Addons for Elementor 60
• EmbedPress 28
• essential blocks 25
• Essential Blocks for Gutenberg 8
• reviewx 8
• NotificationX 7
• BetterDocs 6
• Templately 6
• simple 301 redirects 5
• BetterLinks 3
• SchedulePress 3
• Essential Addons for Elementor Pro 2
• twitter cards meta 2
• Typing Text 2
• Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More 1
• countdown block 1
• Document Block – Upload & Embed Docs 1
• essential blocks pro 1
• Parallax Slider Block 1
• ReviewX – Multi-criteria Rating & Reviews for WooCommerce 1
• Secret Meta 1
• Simple 301 Redirects by BetterLinks 1
• Table Of Contents Block 1

Latest WPDeveloper CVEs

Newest publication first · page 2 of 7

1. CVE-2025-39590 WordPress Essential Addons for Elementor plugin <= 6.1.9 - Cross Site Scripting (XSS) Vulnerability

   Published 2025-04-16

   Medium·CVSS 6.5 EPSS 0.33%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.1.9.

2. CVE-2025-25086 WordPress Secret Meta plugin <= 1.2.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

   Published 2025-03-27

   High·CVSS 7.1 EPSS 0.14%

   Cross-Site Request Forgery (CSRF) vulnerability in WPDeveloper Secret Meta facebook-secret-meta allows Reflected XSS.This issue affects Secret Meta: from n/a through <= 1.2.1.

3. CVE-2025-1664 Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

   Published 2025-03-08

   Medium·CVSS 5.4 EPSS 0.22%

   The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Parallax slider in all versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes...

4. CVE-2024-13803 Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

   Published 2025-02-26

   Medium·CVSS 5.4 EPSS 0.48%

   The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-marker’ parameter in all versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. Thi...

5. CVE-2025-26871 WordPress Essential Blocks plugin <= 4.8.3 - Broken Access Control vulnerability

   Published 2025-02-25

   High·CVSS 8.8 EPSS 0.41%

   Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.8.3.

6. CVE-2025-22696 WordPress Document Block – Upload & Embed Docs, PDF, PPT, XLS or Any Documents plugin <= 1.1.0 - Broken Access Control vulnerability

   Published 2025-02-04

   Medium·CVSS 5.4 EPSS 0.30%

   Missing Authorization vulnerability in WPDeveloper Document Block – Upload & Embed Docs document.This issue affects Document Block – Upload & Embed Docs: from n/a through <= 1.1.0.

7. CVE-2025-22683 WordPress NotificationX plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability

   Published 2025-02-03

   Medium·CVSS 5.4 EPSS 0.32%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper NotificationX notificationx allows Stored XSS.This issue affects NotificationX: from n/a through <= 2.9.5.

8. CVE-2024-12045 Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting

   Published 2025-01-08

   Medium·CVSS 4.8 EPSS 0.25%

   The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maker title value of the Google Maps block in all versions up to, and including, 5.0.9 due to insufficient input sanitization and o...

9. CVE-2025-22315 WordPress Typing Text plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

   Published 2025-01-07

   Medium·CVSS 5.4 EPSS 0.30%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Typing Text typing-text allows Stored XSS.This issue affects Typing Text: from n/a through <= 1.2.7.

10. CVE-2023-45104 WordPress BetterLinks plugin <= 1.6.0 - Broken Access Control vulnerability

    Published 2025-01-02

    High·CVSS 8.8 EPSS 0.46%

    Missing Authorization vulnerability in WPDeveloper BetterLinks betterlinks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BetterLinks: from n/a through <= 1.6.0.

11. CVE-2024-56063 WordPress Essential Addons for Elementor plugin <= 6.0.7 - Cross Site Scripting (XSS) vulnerability

    Published 2024-12-31

    Medium·CVSS 5.4 EPSS 0.26%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.0.7.

12. CVE-2023-40670 WordPress ReviewX plugin <= 1.6.17 - Broken Access Control vulnerability

    Published 2024-12-13

    Medium·CVSS 4.3 EPSS 0.48%

    Missing Authorization vulnerability in ReviewX Team ReviewX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReviewX: from n/a through 1.6.17.

13. CVE-2022-47594 WordPress Essential Blocks for Gutenberg plugin <= 3.8.5 - Broken Access Control

    Published 2024-12-13

    Medium·CVSS 6.5 EPSS 0.43%

    Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through 3.8.5.

14. CVE-2023-47760 WordPress Essential Blocks plugin <= 4.2.0 - Broken Access Control vulnerability

    Published 2024-12-09

    High·CVSS 8.8 EPSS 0.40%

    Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.

15. CVE-2023-47761 WordPress Simple 301 Redirects by BetterLinks plugin <= 2.0.7 - Broken Access Control vulnerability

    Published 2024-12-09

    Medium·CVSS 4.3 EPSS 0.34%

    Missing Authorization vulnerability in WPDeveloper Simple 301 Redirects by BetterLinks simple-301-redirects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple 301 Redirects by BetterLinks: from n/a through <= 2.0.7.

16. CVE-2023-47762 WordPress BetterDocs plugin <= 2.5.2 - Broken Access Control vulnerability

    Published 2024-12-09

    Medium·CVSS 4.3 EPSS 0.34%

    Missing Authorization vulnerability in WPDeveloper BetterDocs betterdocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BetterDocs: from n/a through <= 2.5.2.

17. CVE-2023-51360 WordPress Essential Blocks plugin <= 4.2.0 - Multiple Subscriber+ Broken Access Control vulnerability

    Published 2024-12-09

    High·CVSS 8.8 EPSS 0.58%

    Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.

18. CVE-2023-51359 WordPress Essential Blocks plugin <= 4.2.0 - Multiple Contributor+ Broken Access Control vulnerability

    Published 2024-12-09

    High·CVSS 8.8 EPSS 0.59%

    Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.

19. CVE-2024-11203 EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-S...

    Published 2024-11-28

    Medium·CVSS 5.4 EPSS 0.40%

    The EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘provider_name parameter in all versions up to, and incl...

20. CVE-2024-8978 Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Contributor+) Sensitive Information Exposure

    Published 2024-11-15

    Medium·CVSS 5.7 EPSS 0.49%

    The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.9 via the 'init_content_register_user_email_controls' function...

21. CVE-2024-8979 Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Author+) Sensitive Information Exposure to Privilege Escalation

    Published 2024-11-15

    Medium·CVSS 5.7 EPSS 0.53%

    The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.9 via the 'init_content_lostpassword_user_email_controls' func...

22. CVE-2024-8961 Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Published 2024-11-15

    Medium·CVSS 5.4 EPSS 0.32%

    The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nomore_items_text’ parameter in all versions up to, and including, 6.0.7 due to insufficient input...

23. CVE-2024-51672 WordPress BetterLinks plugin <= 2.1.7 - SQL Injection vulnerability

    Published 2024-11-04

    High·CVSS 7.2 EPSS 0.46%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPDeveloper BetterLinks betterlinks allows SQL Injection.This issue affects BetterLinks: from n/a through <= 2.1.7.

24. CVE-2024-38707 WordPress EmbedPress plugin <= 4.0.4 - Broken Access Control vulnerability

    Published 2024-11-01

    High·CVSS 8.8 EPSS 0.42%

    Missing Authorization vulnerability in WPDeveloper EmbedPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EmbedPress: from n/a through 4.0.4.

25. CVE-2024-43323 WordPress ReviewX plugin <= 1.6.28 - Broken Access Control vulnerability

    Published 2024-11-01

    Critical·CVSS 9.8 EPSS 0.48%

    Missing Authorization vulnerability in ReviewX ReviewX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReviewX: from n/a through 1.6.28.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.