Wpzoom vulnerabilities
We track 6 vulnerabilities in Wpzoom products across 8 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on July 13, 2026.
Latest Wpzoom vulnerabilities
- 7.1 High severity
WPZOOM Portfolio: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Portfolio wpzoom-portfolio allows Reflected XSS.This issue affects WPZOOM Portfolio: from n/a through <= 1.4.29.
- 7.1 High severity
WPZOOM Portfolio: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portfolio allows Reflected XSS. This issue affects WPZOOM Portfolio: from n/a through 1.4.21.
- 8.1 High severity
Inspiro: Cross-Site Request Forgery
The Inspiro theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2. This is due to missing or incorrect nonce validation on the inspiro_install_plugin() function. This makes it possible for unauthenticated a
- 8.8 High severity
Recipe Card Blocks for Gutenberg & Elementor: Missing Authorization
Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through 3.3.1.
- 8.8 High severity
Social Icons Widget & Block by WPZOOM: Missing Authorization
Missing Authorization vulnerability in WPZOOM Social Icons Widget & Block by WPZOOM.This issue affects Social Icons Widget & Block by WPZOOM: from n/a through 4.2.15.
- 9.8 Critical severity
WPZOOM Addons for Elementor – Starter…: Improper Limitation of a Pathname to a Restricted Directory
The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.37 via the 'grid_style' parameter. This makes it possible for unauthenticated attackers to include and exe