Wpdevteam vulnerabilities
We track 13 vulnerabilities in Wpdevteam products across 7 products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest Wpdevteam vulnerabilities
- 7.4 High severity
Essential Addons for Elementor – Popular…: Improper Privilege Management
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the `page_id` parameter of the `register_user()` function. The vulnerability e
- 7.2 High severity
easy.jobs – AI powered Job Listing, Job Board…: Improper Neutralization of Input During Web Page Generation
The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cover_letter' parameter in all versions up to, and including, 2.8.4 due to insufficient inp
- 7.2 High severity
NotificationX – FOMO, Live Sales Notification…: Improper Neutralization of Input During Web Page Generation
The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, an
- 8.8 High severity
Templately – Elementor & Gutenberg Template…: Unrestricted Upload of File with Dangerous Type
The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetch_remote_file function. This is due to a fi
- 8.8 High severity
Essential Addons for Elementor – Popular…: Weak Password Recovery Mechanism for Forgotten Password
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10 This is due to insufficient server-side vali
- 7.2 High severity
Gutenberg Essential Blocks – Page Builder for…: Server-Side Request Forgery
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.3 via the `save_ai_generated_image()` function. This makes it possible for
- 7.2 High severity
NotificationX – FOMO, Live Sales Notification…: Improper Neutralization of Input During Web Page Generation
The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'nx-preview' POST parameter in all vers
- 8.8 High severity
Essential Addons for Elementor – Popular…: Deserialization of Untrusted Data
The Essential Addons for Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.13 via deserialization of untrusted input from the 'error_resetpassword' attribute of the "Login | Register Form" widget (di
- 7.4 High severity
Essential Addons for Elementor – Popular…: Improper Neutralization of Input During Web Page Generation
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's event calendar widget in all versions up to, and including, 5.9.9 due to insu
- 9.8 Critical severity
NotificationX – FOMO, Live Sales Notification…: Improper Neutralization of Special Elements used in an SQL Command
The NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping
- 8.1 High severity
Essential Blocks Pro: Deserialization of Untrusted Data
The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the get_posts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain
- 9.8 Critical severity
Essential Blocks Pro: Deserialization of Untrusted Data
The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the get_products function. This allows unauthenticated attackers to inject a PHP Object. No POP ch
- 7.5 High severity
EmbedPress – PDF Embedder, Embed YouTube…: Use of Hard-coded Cryptographic Key
The EmbedPress plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'lock_content_form_handler' and 'display_password_form' function in versions up to, and including, 3.7.3. This makes it possible for unau