How many CVEs does stellarwp have?

stellarwp has 140 published CVE records since 2019, including 81 in the last two years.

How many stellarwp CVEs are in CISA KEV?

None of stellarwp's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which stellarwp products have the most CVEs?

The stellarwp products with the most published CVEs are GiveWP – Donation Plugin and Fundraising Platform, Kadence Blocks — Page Builder Toolkit for Gutenberg Editor, The Events Calendar, GiveWP, Event Tickets and Registration.

What are the most common weakness types in stellarwp CVEs?

stellarwp's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-352 (Cross-Site Request Forgery (CSRF)).

Are there public exploits for stellarwp vulnerabilities?

Yes — 13 of stellarwp's CVEs have a known public exploit.

How many critical stellarwp vulnerabilities are there?

stellarwp has 14 critical and 28 high-severity CVEs.

What is the average severity of stellarwp CVEs?

The average CVSS base score across stellarwp's scored CVEs is 6.4.

RadicalNotion.AI

Log in Start free

140 CVEs

stellarwp Vulnerabilities

Name: stellarwp vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for stellarwp.

140

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

13

Public exploits

PoC or exploit code

6.4

Avg CVSS

2019–2026

Overview

stellarwp has 140 published CVE records since 2019, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 13 have a known public exploit. The average CVSS base score across scored CVEs is 6.4.

This page aggregates every publicly disclosed vulnerability (CVE) affecting stellarwp products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on stellarwp's vulnerability posture, as a share of its 140 published CVEs.

Average CVSS: 6.4
Critical / high: 30%
Actively exploited (KEV): 0%
Public exploit available: 9%
Patch available: 66%

Severity and exploitation

How the CVSS severity of stellarwp's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical14

High28

Medium98

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of stellarwp's CVEs are currently listed in CISA's KEV catalog.

Public exploits

13

13 of stellarwp's CVEs have a known public exploit available.

Most affected products

The stellarwp products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in stellarwp CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish stellarwp CVE records.

Disclosure activity by year

How many stellarwp CVEs were published each year.

2019

1

2022

1

2023

4

2024

53

2025

46

2026

35

Latest stellarwp CVEs

The most recently disclosed vulnerabilities affecting stellarwp.

WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute
CWE-79
Medium · CVSS 6.4
EPSS 0.2%2026-09-19
The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
CWE-94
Critical · CVSS 9.8
EPSS 0.8%2026-09-12
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
CWE-502
Critical · CVSS 9.8
EPSS 0.8%2026-09-12
Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update
CWE-862
High · CVSS 7.5
EPSS 0.3%2026-09-08
LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint
CWE-862
Medium · CVSS 5.4
EPSS 0.2%2026-09-05
LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler
CWE-434
High · CVSS 7.5
EPSS 0.4%2026-09-04
GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
CWE-79
Medium · CVSS 6.4
EPSS 0.3%2026-08-28
Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover
CWE-640
Critical · CVSS 9.3
EPSS 0.3%2026-08-05
Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content
CWE-79
Medium · CVSS 6.4
EPSS 0.2%2026-08-01
Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute
CWE-79
Medium · CVSS 6.4
EPSS 0.2%2026-08-01
GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting
CWE-79
Medium · CVSS 6.4
EPSS 0.4%2026-07-16
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication
CWE-863
Medium · CVSS 4.3
EPSS 0.4%2026-07-10

Track new stellarwp CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor stellarwp CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

NEC141 CVEs Tungsten Automation141 CVEs anisha140 CVEs Avaya140 CVEs Hitachi Energy140 CVEs Zabbix139 CVEs ruby-lang139 CVEs thimpress139 CVEs

Browse all vendors

Frequently asked questions

Common questions about stellarwp vulnerabilities.

How many CVEs does stellarwp have?: stellarwp has 140 published CVE records since 2019, including 81 in the last two years.
How many stellarwp CVEs are in CISA KEV?: None of stellarwp's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which stellarwp products have the most CVEs?: The stellarwp products with the most published CVEs are GiveWP – Donation Plugin and Fundraising Platform, Kadence Blocks — Page Builder Toolkit for Gutenberg Editor, The Events Calendar, GiveWP, Event Tickets and Registration.
What are the most common weakness types in stellarwp CVEs?: stellarwp's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-352 (Cross-Site Request Forgery (CSRF)).
Are there public exploits for stellarwp vulnerabilities?: Yes — 13 of stellarwp's CVEs have a known public exploit.
How many critical stellarwp vulnerabilities are there?: stellarwp has 14 critical and 28 high-severity CVEs.
What is the average severity of stellarwp CVEs?: The average CVSS base score across stellarwp's scored CVEs is 6.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track stellarwp vulnerabilities

Monitor new stellarwp vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing