WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
avchat-3
Published
2024-10-18
Title
AVChat Video Chat <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
avcp
Published
2023-11-07
Title
ANAC XML Bandi di Gara <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Slug
avcp
Published
2023-11-07
Title
ANAC XML Bandi di Gara <= 7.5 - Cross-Site Request Forgery via settings.php
Slug
avcp
Published
2023-11-07
Title
ANAC XML Bandi di Gara <= 7.5 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
avcp
Published
2025-11-24
Title
ANAC XML Bandi di Gara < 7.7.1 - Reflected Cross-Site Scripting
Slug
ave-core
Published
2026-03-17
Title
Ave Core <= 2.9.1 - Missing Authorization
Slug
avectra-netforum-single-sign-on
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
avectra-netforum-single-sign-on
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
avenirsoft-directdownload
Published
2015-08-09
Title
Avenir-soft Direct Download <= 1.0 - Cross-Site Scripting (XSS) & CSRF
Slug
aviary-image-editor-add-on-for-gravity-forms
Published
2015-06-09
Title
Aviary Image Editor Add-on For Gravity Forms <= 3.0beta - Unauthenticated File Upload
Slug
aviation-weather-from-noaa
Published
2025-06-30
Title
Aviation Weather from NOAA <= 0.7.2 - Authenticated (Subscriber+) Arbitrary File Deletion
Slug
avif-support
Published
2024-09-30
Title
AVIF & SVG Uploader < 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
avif-support
Published
2024-09-16
Title
AVIF & SVG Uploader <= 1.1.0 - Author+ Stored XSS via SVG Uplaod
Slug
avirato-calendar
Published
2023-04-17
Title
Avirato hotels online booking engine <= 5.0.5 - Subscriber+ SQLi
Slug
avishi-wp-paypal-payment-button
Published
2025-07-18
Title
Avishi WP PayPal Payment Button <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
aw-woocommerce-kode-pembayaran
Published
2025-01-16
Title
AW WooCommerce Kode Pembayaran <= 1.1.4 - Reflected Cross-Site Scripting
Slug
awa-plugins
Published
2026-02-25
Title
Awa Plugins <= 1.4.4 - Reflected Cross-Site Scripting
Slug
awcode-toolkit
Published
2025-05-19
Title
AWcode Toolkit < 1.0.19 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
aweber-web-form-widget
Published
2023-11-13
Title
AWeber < 7.3.10 - Missing Authorization via AJAX actions
Slug
aweber-web-form-widget
Published
2024-02-29
Title
AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth By AWeber < 7.3.15 - Authenticated (Admin+) SQL Injection
Slug
aweber-web-form-widget
Published
2024-12-27
Title
AWeber < 7.3.21 - Admin+ Stored XSS
Slug
aweber-wp
Published
2024-12-02
Title
AWeber Forms by Optin Cat < 2.5.8 - Reflected Cross-Site Scripting
Slug
awebooking
Published
2025-12-30
Title
AweBooking <= 3.2.26 - Authenticated (Subscriber+) Information Exposure
Slug
aweos-wp-lock
Published
2025-05-07
Title
AWEOS WP Lock < 1.4.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
awesome-contact-form7-for-elementor
Published
2024-05-22
Title
Awesome Contact Form7 for Elementor < 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via AEP Contact Form 7 Widget