Wpxpo vulnerabilities
We track 14 vulnerabilities in Wpxpo products across 9 products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on October 10, 2026.
Latest Wpxpo vulnerabilities
- 7.2 High severity
Post Grid Gutenberg Blocks – PostX: Improper Neutralization of Input During Web Page Generation
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible
- 7.2 High severity
WowOptin: Next-Gen Popup Maker – Create…: Server-Side Request Forgery
The WowOptin: Next-Gen Popup Maker plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.29. This is due to the plugin exposing a publicly accessible REST API endpoint (optn/v1/integration-action) with a pe
- 7.5 High severity
WowStore – Store Builder & Product Blocks for…: Improper Neutralization of Special Elements used in an SQL Command
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 4.4.3 due to insufficient escaping on the user supplied parameter and lack of suf
- 8.8 High severity
WowOptin: Next-Gen Popup Maker – Create…: Missing Authorization
The WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the 'install_and_active_plugin' function in all ver
- 7.2 High severity
Post Grid Gutenberg Blocks for News…: Server-Side Request Forgery
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.8 via the `/ultp/v3/starter_dummy_post/` and `/ultp/v3/starter_import_content/
- 8.8 High severity
WowRevenue – Product Bundles & Bulk Discounts: Missing Authorization
The WowRevenue plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'Notice::install_activate_plugin' function in all versions up to, and including, 2.1.3. This makes it possible for authenticated atta
- 7.5 High severity
PostX: Missing Authorization
Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 5.0.3.
- 7.5 High severity
Post Grid Gutenberg Blocks for News…: Missing Authorization
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the '/ultp/v2/get_dynamic_content/' REST API endpoint in all versions up to, and in
- 7.2 High severity
PostX: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in WPXPO PostX ultimate-post allows Privilege Escalation.This issue affects PostX: from n/a through <= 4.1.35.
- 7.1 High severity
PostX: Missing Authorization
Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 4.1.36.
- 8.8 High severity
Post Grid Gutenberg Blocks for News…: Missing Authorization
The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the 'install_required_plugin_callback' function in all versions up to, and i
- 8.8 High severity
PostX: Missing Authorization
Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 3.2.3.
- 8.8 High severity
Post Grid Gutenberg Blocks for News…: Missing Authorization
The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'postx_presets_callback' function in all versions up to, and including, 4.1.2. Thi
- 9.8 Critical severity
ProductX – WooCommerce Builder & Gutenberg…: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in wpxpo ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks.This issue affects ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks: from n/a through 3.1.4.