WPDeveloper has 5 CVEs on record between 2025 and 2026. 4 were published in the last 90 days. The busiest recent month was October 2026 with 4. The median CVSS is 6.5 (medium). None have a confirmed exploitation report. Most affected products: essential-addons-for-elementor-lite (2), NotificationX (1), SchedulePress (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Products
- essential-addons-for-elementor-lite 2
- NotificationX 1
- SchedulePress 1
- essential_addons_for_elementor 1
Worst active — by depth score
CVE-2022-51021High· 8.2NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint45CVE-2026-102394Medium· 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons fo…36CVE-2025-69092Medium· 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows DOM-Based XSS.This issue affects Essential Addons…36CVE-2026-110898Medium· 6.4WordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerability35CVE-2026-114120Medium· 5.4SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action30
WPDeveloper vulnerabilities
CVEs affecting WPDeveloper, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2022-51021High· 8.2NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint
NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notification…
CVE-2026-114120Medium· 5.4SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action
SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wps…
CVE-2026-110898Medium· 6.4WordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 6.8.5.
CVE-2026-102394Medium· 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons fo…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons fo…
CVE-2025-69092Medium· 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows DOM-Based XSS.This issue affects Essential Addons…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows DOM-Based XSS.This issue affects Essential Addons…