Stellarwp vulnerabilities
Published CVEs affecting Stellarwp products: 53 record(s), with severity, exploitation and fixes.
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor 11The Events Calendar 9GiveWP – Donation Plugin and Fundraising Platform 9Membership Plugin – Restrict Content 5GiveWP 3LearnDash LMS 3WPComplete 3Event Tickets and Registration 3iThemes Sync 1Bookit — Booking & Appointment Calendar 1Kadence WooCommerce Email Designer 1Restrict Content 1Image Widget 1Event Tickets 1Membership Plugin – Kadence Memberships 1
CVE-2025-11228
Medium · 5.3
CWE-862 Oct 4, 2025
GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `registerAssociateFormsWithCampaign` function in all versions up to, and including, 4.10.0. This makes it possible for unauthenticated attackers to associate any donation forms with any campaign.
CVE-2025-11227
Medium · 6.5
CWE-285 Oct 4, 2025
GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check. This makes it possible for unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns.
CVE-2025-58974
Medium · 6.5
CWE-79 Sep 22, 2025
WordPress WPComplete Plugin <= 2.9.5.2 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through <= 2.9.5.2.