Roxnor vulnerabilities
We track 20 vulnerabilities in Roxnor products across 11 products. 20 are rated high or critical, and none are known to be exploited. The most recent was published on October 31, 2026.
Latest Roxnor vulnerabilities
- 8.8 High severity
Rox Appointment Booking – Event, Calendar &…: Improper Privilege Management
The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booki
- 8.1 High severity
Wp Social Login and Register Social Counter: Improper Authentication
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at `/wp-json/wslu-social-login/type/{provider}/` w
- 8.1 High severity
WP Ultimate Review: Improper Control of Generation of Code
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running d
- 7.2 High severity
ShopEngine Elementor WooCommerce Builder Addon…: Improper Privilege Management
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the `rum_importer()` function being registered on the Wo
- 10.0 Critical severity
ElementsKit Elementor Addons – Advanced…: Missing Authentication for Critical Functionality
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without authentication. The endpoint accept
- 8.2 High severity
Popup builder with Gamification, Multi-Step…: Improper Neutralization of Special Elements used in an SQL Command
The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to generic SQL Injection via the multiple REST API endpoints in all versions up to, and including, 2.2.0 due to insufficie
- 8.5 High severity
PopupKit: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Roxnor PopupKit popup-builder-block allows Blind SQL Injection.This issue affects PopupKit: from n/a through <= 2.1.5.
- 7.5 High severity
Popup builder with Gamification, Multi-Step…: Server-Side Request Forgery
The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.1.4. This is due to insufficient validation on the
- 7.5 High severity
Popup builder with Gamification, Multi-Step…: Improper Neutralization of Special Elements used in an SQL Command
The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1.3. This is due to insufficient escaping on the 'id' parameter a
- 7.5 High severity
FundEngine: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Roxnor FundEngine wp-fundraising-donation allows PHP Local File Inclusion.This issue affects FundEngine: from n/a through <= 1.7.4.
- 9.8 Critical severity
Metform: Missing Authorization
Missing Authorization vulnerability in Roxnor Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through <= 3.4.0.
- 9.8 Critical severity
Wp Social Login and Register Social Counter: Authentication Bypass Using an Alternate Path or Channel
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.0.7. This is due to insufficient verification on the user being returned by the social login token. This makes i
- 9.8 Critical severity
MetForm – Contact Form, Survey, Quiz, & Custom…: Unrestricted Upload of File with Dangerous Type
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and including, 3.2.4. This allows unauthenticated visitors to perform a "double extension" attack and up
- 8.8 High severity
FundEngine – Donation and Crowdfunding Platform: Missing Authorization
The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying user meta updated through the update_user_meta function. This makes it possible for authenti
- 7.5 High severity
MetForm – Contact Form, Survey, Quiz, & Custom…: Exposure of Sensitive Information to an Unauthorized Actor
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the 'handle_file' function. This can allow unauthenticated attackers
- 7.5 High severity
Wp Ultimate Review: Authentication Bypass by Spoofing
Authentication Bypass by Spoofing vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Identity Spoofing.This issue affects Wp Ultimate Review: from n/a through <= 2.3.6.
- 8.8 High severity
ElementsKit Elementor Addons – Advanced…: Improper Control of Filename for Include/Require Statement in PHP Program
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the generate_navigation_markup function of the Onepage Scroll module. This makes it possible for authenticated attackers
- 8.8 High severity
ElementsKit Elementor Addons – Advanced…: Improper Control of Filename for Include/Require Statement in PHP Program
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.6 via the render_raw function. This makes it possible for authenticated attackers, with contributor-level access and above, to
- 7.8 High severity
MetForm – Contact Form, Survey, Quiz, & Custom…: Improper Neutralization of Formula Elements in a CSV File
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution w
- 7.5 High severity
MetForm – Contact Form, Survey, Quiz, & Custom…: Missing Authorization
The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party A