WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
addthis
Published
2015-08-11
Title
AddThis Sharing Buttons <= 5.0.12 - Authenticated Cross-Site Scripting (XSS)
Slug
adforest-elementor
Published
2026-01-20
Title
AdForest Elementor < 3.0.12 - Unauthenticated Stored Cross-Site Scripting
Slug
adfoxly
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
adfoxly
Published
2023-04-14
Title
AdFoxly <= 1.8.5 - Reflected XSS
Slug
adfoxly
Published
2023-11-28
Title
AdFoxly – Ad Manager, AdSense Ads & Ads.txt <= 1.8.5 - Cross-Site Request Forgery
Slug
adfoxly
Published
2024-05-20
Title
AdFoxly – Ad Manager, AdSense Ads & Ads.txt <= 1.8.5 - Missing Authorization to Unauthenticated Ad Status Update
Slug
adfoxly
Published
2024-07-31
Title
AdFoxly – Ad Manager, AdSense Ads & Ads.txt <= 1.8.5 - Missing Authorization to Unauthenticated Ad Status Update
Slug
adiaha-hotel
Published
2025-09-30
Title
Flights & Hotels Booking WP Plugin <= 3.1 - Missing Authorization
Slug
adiaha-hotel
Published
2026-04-09
Title
Travel & Tours Meta Search <= 2.3 - Reflected Cross-Site Scripting
Slug
adiaha-hotel
Published
2026-04-09
Title
Travel & Tours Meta Search <= 2.3 - Unauthenticated SQL Injection
Slug
adicons
Published
2018-12-28
Title
Adicon Server <= 1.2 - SQL Injection
Slug
adicons
Published
2024-08-22
Title
Adicon Server <= 1.2 - Admin+ SQL Injection
Slug
adif-log-search-widget
Published
2014-08-01
Title
ADIF Log Search Widget - Cross-Site Scripting (XSS)
Slug
adif-log-search-widget
Published
2024-10-14
Title
ADIF Log Search Widget <= 1.0f - Reflected Cross-Site Scripting
Slug
adifier-system
Published
2025-01-17
Title
Adifier System < 3.1.8 - Unauthenticated Arbitrary Password Reset
Slug
adirectory
Published
2024-10-24
Title
aDirectory < 1.3.1 - Unauthenticated Arbitrary File Upload
Slug
adirectory
Published
2025-02-11
Title
aDirectory – WordPress Directory Listing Plugin < 2.3.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
Slug
adirectory
Published
2025-01-20
Title
aDirectory – WordPress Directory Listing Plugin < 1.9 - Unauthenticated PHP Object Injection
Slug
adirectory
Published
2026-01-27
Title
aDirectory < 3.0.4 - Missing Authorization
Slug
adl-team
Published
2022-07-07
Title
Team <= 1.2.6 - Contributor+ Stored Cross-Site Scripting
Slug
admail
Published
2025-04-04
Title
AdMail – Multilingual Back in-Stock Notifier for WooCommerce <= 1.7.0 - Missing Authorization
Slug
admin-and-client-message-after-order-for-woocommerce
Published
2024-04-25
Title
OrderConvo < 12.5 - Missing Authorization to Arbitrary File Upload
Slug
admin-and-client-message-after-order-for-woocommerce
Published
2025-01-15
Title
Admin and Customer Messages After Order for WooCommerce < 13.3 - Authenticated (Subscriber+) Limited File Upload to Cross-Site Scripting
Slug
admin-and-client-message-after-order-for-woocommerce
Published
2025-09-16
Title
OrderConvo < 14 - Unauthenticated Arbitrary File Read
Slug
admin-and-client-message-after-order-for-woocommerce
Published
2025-11-24
Title
Admin and Customer Messages After Order for WooCommerce: OrderConvo < 15 - Missing Authorization to Unauthenticated User Impersonation in Order Messages