WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
abcbiz-addons
Published
2024-12-05
Title
ABCBiz Addons for Elementor <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
abcsubmit
Published
2025-04-25
Title
Create custom forms for WordPress with a smart form plugin for smart businesses <= 1.2.4 - Unauthenticated Arbitrary Shortcode Execution
Slug
abeta-punchout
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
abeta-punchout
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
abitgone-commentsafe
Published
2024-01-23
Title
aBitGone CommentSafe <= 1.0.0 - Settings Update to Stored XSS via CSRF
Slug
ableplayer
Published
2025-04-24
Title
Able Player, accessible HTML5 media player < 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via preload Parameter
Slug
ableplayer
Published
2025-04-24
Title
Able Player < 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
ablocks
Published
2025-02-17
Title
aBlocks – WordPress Gutenberg Blocks < 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
ablocks
Published
2025-05-07
Title
aBlocks < 1.9.3 - Contributor+ Stored XSS
Slug
about-author
Published
2019-10-25
Title
About Author < 1.4.0 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
about-author
Published
2025-03-27
Title
About Author < 1.6.3 - Reflected Cross-Site Scripting
Slug
about-author-box
Published
2021-10-26
Title
About Author Box < 1.0.2 - Contributor+ Stored Cross-Site Scripting
Slug
about-me
Published
2022-08-25
Title
About Me <= 1.0.12 - Subscriber+ Arbitrary Network Creation/Deletion
Slug
about-me-3000
Published
2023-03-03
Title
About Me 3000 widget <= 2.2.6 - CSRF
Slug
about-me-3000
Published
2023-06-22
Title
About Me 3000 widget <= 2.2.6 - Administrator Stored Cross-Site Scripting
Slug
about-rentals
Published
2022-08-25
Title
About Rentals <= 1.5 - Unauthenticated Actions
Slug
absolute-addons
Published
2024-11-20
Title
Absolute Addons For Elementor <= 1.0.14 - Authenticated (Contributor+) Local File Inclusion
Slug
absolute-links
Published
2025-04-25
Title
Absolute Links <= 1.1.1 - Authenticated (Administrator+) SQL Injection
Slug
absolute-privacy
Published
2023-08-09
Title
Absolute Privacy <= 2.1 - User Email/Password Change via Cross-Site Request Forgery
Slug
absolute-reviews
Published
2021-06-08
Title
CSRF Bypass in Multiple Plugins
Slug
absolute-reviews
Published
2024-09-26
Title
Absolute Reviews < 1.1.4 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Criteria Name
Slug
abstract-submission
Published
2020-03-24
Title
Multiple plugins - Unauthenticated Dompdf Local File Inclusion (LFI)
Slug
abtest
Published
2014-08-01
Title
ABtest - Directory Traversal
Slug
abtest
Published
2016-03-21
Title
ABtest - File Inclusion
Slug
abundatrade-plugin
Published
2025-05-02
Title
Abundatrade Plugin <= 1.8.02 - Cross-Site Request Forgery to Stored Cross-Site Scripting