WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
app-builder
Published
2024-04-05
Title
App Builder < 3.8.8 - Open Redirection
Slug
app-builder
Published
2024-04-16
Title
App Builder < 3.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
app-builder
Published
2024-08-20
Title
App Builder – Create Native Android & iOS Apps On The Flight < 4.3.4 - Unauthenticated Limited SQL Injection via app-builder-search
Slug
app-builder
Published
2024-10-24
Title
App Builder – Create Native Android & iOS Apps On The Flight < 5.3.8 - Privilege Escalation and Account Takeover via Weak OTP
Slug
app-builder
Published
2025-06-19
Title
App Builder < 5.5.8 - Missing Authorization
Slug
app-builder
Published
2026-03-20
Title
App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter
Slug
app-builder
Published
2026-05-01
Title
App Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter
Slug
app-template-blocks-for-wpbakery-page-builder
Published
2025-12-11
Title
App Landing Template Blocks for WPBakery Page Builder <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
appbanners
Published
2025-06-05
Title
AppBanners <= 1.5.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
append-content
Published
2025-04-01
Title
Append Content <= 2.1.1 - Cross-Site Request Forgery to Settings Update
Slug
append-extensions-on-pages
Published
2025-09-22
Title
Append extensions on Pages <= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
append-link-on-copy
Published
2025-09-22
Title
Append Link on Copy <= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
appender
Published
2025-12-31
Title
Appender <= 1.1.1 - Missing Authorization
Slug
apperr
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
appexperts
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
appexperts
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
appexperts
Published
2025-03-24
Title
AppExperts < 1.4.5 - Unauthenticated Sensitive Information Exposure
Slug
appexperts
Published
2025-10-09
Title
AppExperts <= 1.4.5 - Unauthenticated Sensitive Information Exposure
Slug
appexperts
Published
2026-01-22
Title
AppExperts <= 1.4.5 - Authenticated (Subscriber+) SQL Injection
Slug
appizy-app-embed
Published
2025-01-06
Title
App Embed < 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
applay-shortcodes
Published
2026-02-17
Title
Applay - Shortcodes <= 3.7 - Authenticated (Contributor+) PHP Object Injection
Slug
applicantpro
Published
2025-01-16
Title
Isolved Talent Acquisition < 1.4.0 - Reflected Cross-Site Scripting
Slug
application-passwords
Published
2025-12-05
Title
Application Passwords <= 0.1.3 - Reflected Cross-Site Scripting via reject_url
Slug
applixir
Published
2026-03-20
Title
Reward Video Ad for WordPress <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings
Slug
apply-online
Published
2023-06-26
Title
ApplyOnline < 2.5.6 - Admin+ Stored XSS