How many CVEs have patched register_controls?

10 published CVEs changed register_controls in wordpress-plugins/plugins, in 18 distinct patches totalling 330 changed lines, between 2024 and 2026.

What is the latest CVE that changed register_controls?

CVE-2025-8615 (CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode), published 2026-01-17, changed lines 145 to 302 of cubewp-framework/trunk/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-posts-widget.php.

How does register_controls compare to the rest of wordpress-plugins/plugins?

wordpress-plugins/plugins has 851 CVEs with a located fix in total; 10 of them changed register_controls.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

register_controls in wordpress-plugins/plugins: Patched by 10 CVEs

CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode

CVE-2025-8615 · cubewp-framework/trunk/cube/classes/page-builders/elementor-widgets/class-cubewp-elementor-posts-widget.php · lines 145–302 · +63 −1 in 3 hunks

Medium · CVSS 6.4

EPSS 0.2%2026-01-17

LC Wizard 1.2.10 - 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation

CVE-2025-5483 · ghl-wizard/trunk/inc/elementor.php · lines 39–124 · +20 −14 in 7 hunks

High · CVSS 8.1

EPSS 0.3%2025-11-07

The Pack Elementor addon <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2025-6550 · the-pack-addon/trunk/includes/widgets/element/accordion/index.php · line 78 · +1 −1

Medium · CVSS 6.4

EPSS 0.3%2025-06-27

Recently Purchased Products For Woo <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via view Parameter

CVE-2025-1008 · recently-purchased-products-for-woo/trunk/includes/widget/class-rppw-elementor-widget.php · lines 49–319 · +21 −21 in 16 hunks

Medium · CVSS 6.4

EPSS 0.3%2025-03-05

Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and eae_slider_animation Parameters

CVE-2024-4401 · addon-elements-for-elementor-page-builder/trunk/modules/thumb-gallery/widgets/thumb-gallery.php · line 1097 · +1 −0

Medium · CVSS 6.4

EPSS 0.3%2024-08-30

Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2024-4570 · addon-elements-for-elementor-page-builder/trunk/modules/thumb-gallery/widgets/thumb-gallery.php · line 1097 · +1 −0

Medium · CVSS 6.4

EPSS 0.3%2024-06-27

Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2024-4569 · addon-elements-for-elementor-page-builder/trunk/modules/thumb-gallery/widgets/thumb-gallery.php · line 1097 · +1 −0

Medium · CVSS 6.4

EPSS 0.4%2024-06-27

LA-Studio Element Kit for Elementor <= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

CVE-2024-4431 · lastudio-element-kit/trunk/includes/addons/author-box.php · lines 346–370 · +3 −18 in 3 hunks

Medium · CVSS 6.4

EPSS 0.4%2024-05-23

LA-Studio Element Kit for Elementor <= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

CVE-2024-4431 · lastudio-element-kit/trunk/includes/addons/hamburger-panel.php · lines 181–271 · +2 −1 in 2 hunks

Medium · CVSS 6.4

EPSS 0.4%2024-05-23

LA-Studio Element Kit for Elementor <= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

CVE-2024-4431 · lastudio-element-kit/trunk/includes/addons/nav-menu.php · lines 264–387 · +27 −11 in 5 hunks

Medium · CVSS 6.4

EPSS 0.4%2024-05-23

LA-Studio Element Kit for Elementor <= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

CVE-2024-4431 · lastudio-element-kit/trunk/includes/addons/team-member.php · line 460 · +0 −1

Medium · CVSS 6.4

EPSS 0.4%2024-05-23

LA-Studio Element Kit for Elementor <= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

CVE-2024-4431 · lastudio-element-kit/trunk/includes/modules/nested-elements/widgets/nested-tabs.php · lines 1032–1043 · +12 −0

Medium · CVSS 6.4

EPSS 0.4%2024-05-23

WPKoi Templates for Elementor <= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters

CVE-2024-4980 · wpkoi-templates-for-elementor/trunk/elements/elements/darkmode/darkmode.php · lines 182–206 · +2 −2 in 2 hunks

Medium · CVSS 6.4

EPSS 0.3%2024-05-22

Shortcodes and extra features for Phlox theme <= 2.17.5 - Authenticated (Subscriber+) PHP Object Injection via auxin_template_control_importer

CVE-2023-7064 · auxin-elements/trunk/includes/elementor/widgets/button.php · lines 326–367 · +35 −0 in 2 hunks

High · CVSS 7.5

EPSS 0.9%2024-05-02

Shortcodes and extra features for Phlox theme <= 2.17.5 - Authenticated (Subscriber+) PHP Object Injection via auxin_template_control_importer

CVE-2023-7064 · auxin-elements/trunk/includes/elementor/widgets/recent-posts-grid-carousel.php · lines 610–626 · +15 −2

High · CVSS 7.5

EPSS 0.9%2024-05-02

Shortcodes and extra features for Phlox theme <= 2.17.5 - Authenticated (Subscriber+) PHP Object Injection via auxin_template_control_importer

CVE-2023-7064 · auxin-elements/trunk/includes/elementor/widgets/recent-posts-land-style.php · lines 306–322 · +15 −2

High · CVSS 7.5

EPSS 0.9%2024-05-02

Shortcodes and extra features for Phlox theme <= 2.17.5 - Authenticated (Subscriber+) PHP Object Injection via auxin_template_control_importer

CVE-2023-7064 · auxin-elements/trunk/includes/elementor/widgets/recent-posts-masonry.php · lines 384–400 · +15 −2

High · CVSS 7.5

EPSS 0.9%2024-05-02

Shortcodes and extra features for Phlox theme <= 2.17.5 - Authenticated (Subscriber+) PHP Object Injection via auxin_template_control_importer

CVE-2023-7064 · auxin-elements/trunk/includes/elementor/widgets/recent-posts-timeline.php · lines 299–315 · +15 −2

High · CVSS 7.5

EPSS 0.9%2024-05-02

Shortcodes and extra features for Phlox theme <= 2.17.5 - Authenticated (Subscriber+) PHP Object Injection via auxin_template_control_importer

CVE-2023-7064 · auxin-elements/trunk/includes/elementor/widgets/theme-elements/breadcrumbs.php · line 363 · +1 −1

High · CVSS 7.5

EPSS 0.9%2024-05-02

Shortcodes and extra features for Phlox theme <= 2.17.5 - Authenticated (Subscriber+) PHP Object Injection via auxin_template_control_importer

CVE-2023-7064 · auxin-elements/trunk/includes/elementor/widgets/theme-elements/modern-search.php · line 284 · +1 −0

High · CVSS 7.5

EPSS 0.9%2024-05-02

register_controls

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track wordpress-plugins/plugins CVEs