PickPlugins vulnerabilities
We track 25 vulnerabilities in PickPlugins products across 14 products. 25 are rated high or critical, and none are known to be exploited. The most recent was published on October 28, 2026.
Latest PickPlugins vulnerabilities
- 7.2 High severity
Accordion: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through 2.3.25.
- 9.8 Critical severity
Post Grid: Improper Control of Generation of Code
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthentic
- 7.5 High severity
PickPlugins Question Answer: Improper Neutralization of Special Elements used in an SQL Command
The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with th
- 9.8 Critical severity
User Verification by PickPlugins: Authentication Bypass Using an Alternate Path or Channel
The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "user_verification_form_wrap_p
- 9.8 Critical severity
User Verification by PickPlugins: Improper Authentication
The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.44. This is due to the plugin not properl
- 8.8 High severity
Post Grid and Gutenberg Blocks: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Object Injection.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.11.
- 8.8 High severity
Question Answer: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in PickPlugins Question Answer question-answer allows Object Injection.This issue affects Question Answer: from n/a through <= 1.2.73.
- 7.1 High severity
Question Answer: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Question Answer question-answer allows Reflected XSS.This issue affects Question Answer: from n/a through <= 1.2.70.
- 7.1 High severity
Wishlist: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Wishlist wishlist allows Reflected XSS.This issue affects Wishlist: from n/a through <= 1.0.39.
- 8.5 High severity
Wishlist: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist wishlist allows SQL Injection.This issue affects Wishlist: from n/a through <= 1.0.46.
- 8.8 High severity
Job Board Manager: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in PickPlugins Job Board Manager job-board-manager allows Object Injection.This issue affects Job Board Manager: from n/a through <= 2.1.61.
- 8.8 High severity
Accordion: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through <= 2.3.11.
- 8.8 High severity
Testimonial Slider: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in PickPlugins Testimonial Slider testimonial allows Object Injection.This issue affects Testimonial Slider: from n/a through <= 2.0.13.
- 7.5 High severity
Post Grid: Exposure of Sensitive Information to an Unauthorized Actor
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.6 via the /wp-json/post-grid/v2/get_users REST API This makes it possible for unauthenticated attack
- 8.5 High severity
Wishlist: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist wishlist allows SQL Injection.This issue affects Wishlist: from n/a through <= 1.0.41.
- 7.1 High severity
Job Board Manager: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager job-board-manager allows Reflected XSS.This issue affects Job Board Manager: from n/a through <= 2.1.61.
- 8.8 High severity
Post Grid, Slider & Carousel Ultimate – with…: Improper Control of Filename for Include/Require Statement in PHP Program
The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' attribute of the `pgcu` shortcode. This makes
- 9.8 Critical severity
Post Grid and Gutenberg Blocks – ComboBlocks: Improper Privilege Management
The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in versions 2.2.85 to 2.3.3. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for
- 9.8 Critical severity
Mail Picker: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker mail-picker allows Object Injection.This issue affects Mail Picker: from n/a through <= 1.0.14.
- 7.5 High severity
Product Designer: Missing Authorization
Missing Authorization vulnerability in PickPlugins Product Designer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Product Designer: from n/a through 1.0.33.
- 8.8 High severity
Post Grid and Gutenberg Blocks: Incorrect Privilege Assignment
The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to 2.2.90. This is due to the plugin not properly restricting what user meta values can be updated and ensuring a form is active. This makes it
- 7.5 High severity
Post Grid: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid.This issue affects Post Grid: from n/a through 2.2.78.
- 7.1 High severity
Post Grid: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid allows Reflected XSS.This issue affects Post Grid: from n/a through 2.2.74.
- 7.5 High severity
Post Grid: Exposure of Sensitive Information Through Data Queries
The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.68 via the 'get_posts' REST API Endpoint. This makes it possible for unauthenticated attackers to extract
- 7.5 High severity
Post Grid Combo – 36+ Gutenberg Blocks: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Combo – 36+ Gutenberg Blocks: from n/a through 2.2.50.