CE21 Suite

CE21 Suite has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; 2 are fixed and 4 remain unpatched as of September 2026. Their average CVSS score is 9.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 5 critical and 0 high. 2024 was the busiest year with 4 disclosures.

The most common weakness is Authentication Bypass Using An Alternate Path Or Channel, behind 1 of the records (17%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Improper Privilege Management.

2 of the records (33%) have a vendor fix, while 4 remain unpatched. The oldest unresolved one dates back to 2024.

3 independent researchers contributed these findings, most of them (3) reported by István Márton. CE21 Suite is installed on roughly 50 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSCritical

9.3/ 10

Patch Coverage33%

Open

Fixed

Get automatic notifications for all CE21 Suite vulnerabilities before they are exploited.

Most severe open issueCVSS 9.8CVE-2025-11008

CE21 Suite <= 2.3.1 - Unauthenticated Sensitive Information Exposure to Privilege Escalation

Read the full analysis

Vulnerability Records

6 records


2025-11-03 15:24	CE21 Suite <= 2.3.1 - Unauthenticated Sensitive Information Exposure to Privilege Escalation CE21 Suite <= 2.3.1	`CVE-2025-11008`	9.8 Critical	kr0d	No
2025-11-03 15:23	CE21 Suite 2.2.1 - 2.3.1 - Missing Authorization to Unauthenticated Privilege Escalation via Plugin Settings Update CE21 Suite 2.2.1 – 2.3.1	`CVE-2025-11007`	9.8 Critical	kr0d	No
2024-12-11 00:00	CE21 Suite <= 2.2.0 - Unauthenticated Privilege Escalation CE21 Suite <= 2.2.0	`CVE-2024-54293`	9.8 Critical	stealthcopter	Yes
2024-11-08 00:00	CE21 Suite <= 2.2.0 - Authentication Bypass CE21 Suite <= 2.2.0	`CVE-2024-10284`	9.8 Critical	István Márton	Yes
2024-11-08 00:00	CE21 Suite <= 2.2.0 - JWT Token Disclosure CE21 Suite <= 2.2.0	`CVE-2024-10285`	9.8 Critical	István Márton	No
2024-11-08 00:00	CE21 Suite <= 2.2.0 - Missing Authorization to Unauthenticated Plugin Settings Change CE21 Suite <= 2.2.0	`CVE-2024-10294`	6.5 Medium	István Márton	No

Showing 1–6 of 6 reports

Latestv2.3.7

CE21 Suite

Author

CE21

0.0(0)

0/100

Last Updated

2026-08-24 (19d ago)

Active Installs

50+

Downloads

4,051

Requires WP

6.3+

Requires PHP

7.4+

Tested up to

WP 7.1

Created

2023-01-05 (4y ago)

This plugin allows you to add CE21 components to your WordPress site. It includes widgets for displaying classified ads, a directory of members, a calendar of programs, and a shortcode for displaying CE21 resources.

View on WordPress.org