---
title: "StellarWP vulnerabilities: CVEs, CISA KEV and security advisories"
url: https://radicalnotion.ai/vendor/stellarwp
type: vendor
description: "StellarWP has 143 published CVEs, 0 in CISA KEV and 13 with public exploits."
updated: 2026-11-05
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# StellarWP vulnerabilities

- **Published CVEs:** 143
- **In CISA KEV:** 0
- **With a public exploit:** 13
- **With a patch:** 143
- **Average CVSS:** 6.4
- **CVEs in the last two years:** 84
- **First CVE:** 2019-08-21
- **Latest CVE:** 2026-11-05

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 14 |
| High | 29 |
| Medium | 100 |
| Low | 0 |
| Unscored | 0 |

## Most affected products

| Product | CVEs |
| --- | --- |
| [GiveWP – Donation Plugin and Fundraising Platform](https://radicalnotion.ai/vendor/stellarwp/givewp-donation-plugin-and-fundraising-platform) | 34 |
| [Kadence Blocks — Page Builder Toolkit for Gutenberg Editor](https://radicalnotion.ai/vendor/stellarwp/kadence-blocks-page-builder-toolkit-for-gutenberg-editor) | 30 |
| [The Events Calendar](https://radicalnotion.ai/vendor/stellarwp/the-events-calendar) | 26 |
| [Event Tickets and Registration](https://radicalnotion.ai/vendor/stellarwp/event-tickets-and-registration) | 8 |
| [GiveWP](https://radicalnotion.ai/vendor/stellarwp/givewp) | 8 |
| [LearnDash LMS](https://radicalnotion.ai/vendor/stellarwp/learndash-lms) | 7 |
| [Membership Plugin – Restrict Content](https://radicalnotion.ai/vendor/stellarwp/membership-plugin-restrict-content) | 7 |
| [WPComplete](https://radicalnotion.ai/vendor/stellarwp/wpcomplete) | 4 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 49 |
| [CWE-862](https://radicalnotion.ai/cwe/cwe-862) | Missing Authorization | 30 |
| [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 11 |
| [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 10 |
| [CWE-502](https://radicalnotion.ai/cwe/cwe-502) | Deserialization of Untrusted Data | 8 |
| [CWE-639](https://radicalnotion.ai/cwe/cwe-639) | Authorization Bypass Through User-Controlled Key | 6 |
| [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 6 |
| [CWE-918](https://radicalnotion.ai/cwe/cwe-918) | Server-Side Request Forgery (SSRF) | 4 |

## Assigning CNAs

| CNA | CVEs |
| --- | --- |
| [Wordfence](https://radicalnotion.ai/cna/wordfence) | 107 |
| [Patchstack](https://radicalnotion.ai/cna/patchstack) | 30 |
| [WPScan](https://radicalnotion.ai/cna/wpscan) | 5 |
| [mitre](https://radicalnotion.ai/cna/mitre) | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2019 | 1 |
| 2020 | 0 |
| 2021 | 0 |
| 2022 | 1 |
| 2023 | 4 |
| 2024 | 53 |
| 2025 | 45 |
| 2026 | 39 |

## Latest CVEs

| CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-118193 | GiveWP \<= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor\_default\_user\_role' Parameter | high | 8.8 | 0.4% | No | 2026-11-05 |
| CVE-2026-97643 | GiveWP \<= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp\_campaign\_grid Shortcode Attributes | medium | 6.4 | 0.2% | No | 2026-10-10 |
| CVE-2026-104762 | Kadence Blocks \<= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute | medium | 6.4 | 0.2% | No | 2026-10-10 |
| CVE-2026-97634 | Event Tickets and Registration \<= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter | medium | 6.5 | 0.3% | No | 2026-10-02 |
| CVE-2026-77820 | WPComplete \<= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute | medium | 6.4 | 0.3% | No | 2026-09-19 |
| CVE-2026-78159 | The Events Calendar \<= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation | critical | 9.8 | 1.4% | No | 2026-09-12 |
| CVE-2026-78006 | The Events Calendar \<= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution | critical | 9.8 | 1.5% | No | 2026-09-12 |
| CVE-2026-3174 | Event Tickets and Registration \<= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update | high | 7.5 | 0.5% | No | 2026-09-08 |
| CVE-2026-12843 | LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint | medium | 5.4 | 0.3% | No | 2026-09-05 |
| CVE-2026-12483 | LearnDash LMS \<= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler | high | 7.5 | 0.6% | No | 2026-09-04 |
| CVE-2026-5510 | GiveWP \<= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | medium | 6.4 | 0.4% | No | 2026-08-28 |
| CVE-2026-9273 | Membership Plugin – Kadence Memberships \<= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover | critical | 9.3 | 0.5% | No | 2026-08-05 |

## Frequently asked questions

### How many CVEs does StellarWP have?

StellarWP has 143 published CVE records since 2019, including 84 in the last two years.

### How many StellarWP CVEs are in CISA KEV?

None of StellarWP's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Which StellarWP products have the most CVEs?

The StellarWP products with the most published CVEs are GiveWP – Donation Plugin and Fundraising Platform, Kadence Blocks — Page Builder Toolkit for Gutenberg Editor, The Events Calendar, Event Tickets and Registration, GiveWP.

### What are the most common weakness types in StellarWP CVEs?

StellarWP's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-352 (Cross-Site Request Forgery (CSRF)).

### Are there public exploits for StellarWP vulnerabilities?

Yes — 13 of StellarWP's CVEs have a known public exploit.

### How many critical StellarWP vulnerabilities are there?

StellarWP has 14 critical and 29 high-severity CVEs.

### What is the average severity of StellarWP CVEs?

The average CVSS base score across StellarWP's scored CVEs is 6.4.

## Related vendors

- [Zabbix](https://radicalnotion.ai/vendor/zabbix) (145 CVEs)
- [graalvm](https://radicalnotion.ai/vendor/graalvm) (145 CVEs)
- [Veritas](https://radicalnotion.ai/vendor/veritas) (144 CVEs)
- [Fuji Electric](https://radicalnotion.ai/vendor/fuji-electric) (144 CVEs)
- [xmlsoft](https://radicalnotion.ai/vendor/xmlsoft) (144 CVEs)
- [parseplatform](https://radicalnotion.ai/vendor/parseplatform) (143 CVEs)
- [axiomatic-systems](https://radicalnotion.ai/vendor/axiomaticsystems) (142 CVEs)
- [WPChill](https://radicalnotion.ai/vendor/wpchill) (142 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/stellarwp). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.