wpWax vulnerabilities
We track 20 vulnerabilities in wpWax products across 15 products. 20 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest wpWax vulnerabilities
- 8.1 High severity
Directorist: AI-Powered Business Directory…: Missing Authorization
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to p
- 7.2 High severity
FormGent – Next-Gen AI Form Builder for…: Improper Neutralization of Input During Web Page Generation
The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input s
- 9.1 Critical severity
FormGent – Next-Gen AI Form Builder for…: Missing Authorization
The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API r
- 9.8 Critical severity
Directorist: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through <= 8.8.2.
- 8.5 High severity
Directorist Booking: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection. This issue affects Directorist Booking: from n/a through 3.0.3.
- 8.6 High severity
FormGent: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpWax FormGent formgent allows Path Traversal.This issue affects FormGent: from n/a through <= 1.7.0.
- 7.1 High severity
Directorist: Missing Authorization
Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.6.6.
- 8.1 High severity
Directorist: AI-Powered Business Directory…: Improper Limitation of a Pathname to a Restricted Directory
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to arbitrary file move due to insufficient file path validation in the add_listing_action AJAX action in all versions up to, and including, 8.
- 9.8 Critical severity
HelpGent: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in wpWax HelpGent helpgent allows Object Injection.This issue affects HelpGent: from n/a through <= 2.2.5.
- 9.8 Critical severity
Directorist: AI-Powered Business Directory…: Weak Password Recovery Mechanism for Forgotten Password
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 8.1. This is due to the directorist_generate_password_reset
- 8.8 High severity
Post Grid, Slider & Carousel Ultimate: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Post Grid, Slider & Carousel Ultimate post-grid-carousel-ultimate allows PHP Local File Inclusion.This issue affects Post Grid, Slide
- 8.8 High severity
Post Grid, Slider & Carousel Ultimate – with…: Improper Limitation of a Pathname to a Restricted Directory
The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' parameter of the post_type_ajax_handler() fun
- 8.8 High severity
Post Grid, Slider & Carousel Ultimate – with…: Improper Control of Filename for Include/Require Statement in PHP Program
The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' attribute of the `pgcu` shortcode. This makes
- 8.8 High severity
Product Carousel Slider & Grid Ultimate for…: Improper Control of Filename for Include/Require Statement in PHP Program
The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.10 via the 'theme' attribute of the `wcpcsu` shortcode. This makes it possible for authenticated at
- 8.8 High severity
Post Grid, Slider & Carousel Ultimate – with…: Deserialization of Untrusted Data
The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.7 via deserialization of untrusted input in the outpost_shortcod
- 7.5 High severity
Logo Showcase Ultimate – Logo Carousel, Logo…: Deserialization of Untrusted Data
The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8 via deserialization via shortcode of untrusted input. This makes it possible for authenti
- 8.8 High severity
Product Carousel Slider & Grid Ultimate for…: Deserialization of Untrusted Data
The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input via shortcode. This makes it possible for authenticated at
- 8.8 High severity
Legal Pages – Privacy Policy, Terms &…: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator plugin <= 1.3.8 versions.
- 8.8 High severity
Directorist – WordPress Business Directory…: Improper Neutralization of Formula Elements in a CSV File
Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing.This issue affects Directorist – WordPress Business Directory Plugin with Classified Ads Listings: fr
- 8.8 High severity
The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in…
The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4. This is due to a lack of validation checks within login.php. This makes it possible for authenticated attackers, with subscriber-lev