QODE has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 7.1 (high). None have a confirmed exploitation report. The most common weakness class is CWE-79 (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Products
- Bridge - Creative Multipurpose WordPress Theme 1
- Qode Music 1
- Qode Real Estate 1
- Qode Tours 1
- qi-addons-for-elementor 1
Worst active — by depth score
CVE-2026-42712High· 8.5Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.47CVE-2026-42632High· 7.1Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.39CVE-2026-42631High· 7.1Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.39CVE-2026-62079Medium· 6.5Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.36CVE-2026-15609Medium· 6.4The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitizati…35
QODE vulnerabilities
CVEs affecting QODE, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-42712High· 8.5Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.
Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.
CVE-2026-42632High· 7.1Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.
CVE-2026-42631High· 7.1Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.
CVE-2026-62079Medium· 6.5Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.
Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.
CVE-2026-15609Medium· 6.4The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitizati…
The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitizati…