StellarWP vulnerabilities
We track 32 vulnerabilities in StellarWP products across 12 products. 32 are rated high or critical, and none are known to be exploited. The most recent was published on November 5, 2026.
Latest StellarWP vulnerabilities
- 8.8 High severity
GiveWP – Donation Plugin and Fundraising…: Improper Privilege Management
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.19.1 via the `donor_default_user_role` parameter. This is due to the `sanitize_option_donor_default_user_ro
- 9.8 Critical severity
The Events Calendar: Improper Control of Generation of Code
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to
- 9.8 Critical severity
The Events Calendar: Deserialization of Untrusted Data
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed
- 7.5 High severity
Event Tickets and Registration: Missing Authorization
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenti
- 7.5 High severity
LearnDash LMS: Unrestricted Upload of File with Dangerous Type
The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndash_fileupload_process' function, which iterates through an entire array and
- 9.3 Critical severity
Membership Plugin – Kadence Memberships: Weak Password Recovery Mechanism for Forgotten Password
The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler
- 7.5 High severity
Restrict Content: Missing Authorization
Missing Authorization vulnerability in StellarWP Restrict Content restrict-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict Content: from n/a through <= 3.2.22.
- 7.5 High severity
The Events Calendar: Improper Limitation of a Pathname to a Restricted Directory
The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read th
- 8.1 High severity
Membership Plugin – Restrict Content: Missing Authorization
The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.20. This is due to the `rcp_setup_registration_init()` function accepting any membership level ID via the `rcp_level`
- 7.5 High severity
Membership Plugin – Restrict Content: Authorization Bypass Through User-Controlled Key
The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 3.2.16 via the 'rcp_stripe_create_setup_intent_for_saved_card' function due to missing capability check. Additionally, t
- 7.2 High severity
Kadence WooCommerce Email Designer: Improper Neutralization of Input During Web Page Generation
The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer name in all versions up to, and including, 1.5.17 due to insufficient input sanitization and output escaping. This makes it possible for u
- 7.5 High severity
Bookit — Booking & Appointment Calendar: Missing Authorization
The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and includ
- 7.5 High severity
The Events Calendar: Improper Neutralization of Special Elements used in an SQL Command
The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi
- 7.5 High severity
Event Tickets and Registration: Authorization Bypass Through User-Controlled Key
The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-json/tribe/tickets/v1/commerce/free/order endpoint not verifying that a ticket type should be free allo
- 7.5 High severity
The Events Calendar: Improper Neutralization of Special Elements used in an SQL Command
The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the ‘s’ parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exis
- 7.2 High severity
Kadence WooCommerce Email Designer: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in StellarWP Kadence WooCommerce Email Designer kadence-woocommerce-email-designer allows Privilege Escalation.This issue affects Kadence WooCommerce Email Designer: from n/a through <= 1.5.16.
- 9.1 Critical severity
Kadence WooCommerce Email Designer: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in StellarWP Kadence WooCommerce Email Designer kadence-woocommerce-email-designer allows Upload a Web Shell to a Web Server.This issue affects Kadence WooCommerce Email Designer: from n/a through <
- 7.1 High severity
Event Tickets: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP Event Tickets event-tickets allows Reflected XSS.This issue affects Event Tickets: from n/a through <= 5.20.0.
- 7.5 High severity
GiveWP – Donation Plugin and Fundraising…: Missing Authorization
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in all versions up to, and including, 3.22.0. This makes it possib
- 9.8 Critical severity
GiveWP – Donation Plugin and Fundraising…: Deserialization of Untrusted Data
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'card_address' parameter. This makes it possible for unauthen
- 7.5 High severity
Membership Plugin – Restrict Content: Exposure of Sensitive Information to an Unauthorized Actor
The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.13 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract se
- 8.8 High severity
Gutenberg Blocks by Kadence Blocks: Missing Authorization
Missing Authorization vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through <= 3.3.1.
- 9.8 Critical severity
GiveWP: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3.
- 9.8 Critical severity
GiveWP – Donation Plugin and Fundraising…: Deserialization of Untrusted Data
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. This makes it possible
- 9.8 Critical severity
GiveWP: Missing Authorization
Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through <= 2.33.1.
- 9.8 Critical severity
GiveWP – Donation Plugin and Fundraising…: Deserialization of Untrusted Data
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 via deserialization of untrusted input from the give_company_name parameter. This makes it possible fo
- 9.8 Critical severity
GiveWP – Donation Plugin and Fundraising…: Deserialization of Untrusted Data
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. Th
- 7.2 High severity
GiveWP – Donation Plugin and Fundraising…: Improper Neutralization of Special Elements used in an SQL Command
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of
- 9.8 Critical severity
The Events Calendar: Improper Neutralization of Special Elements used in an SQL Command
The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of suf
- 9.8 Critical severity
GiveWP – Donation Plugin and Fundraising…: Deserialization of Untrusted Data
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for una
- 8.8 High severity
LearnDash LMS: Authorization Bypass Through User-Controlled Key
The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system reso
- 9.8 Critical severity
Bookit — Booking & Appointment Calendar: Missing Authentication for Critical Functionality
The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for una