WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
create-custom-dashboard-widget
Published
2024-11-08
Title
Custom Dashboard Widget <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
create-custom-dashboard-widget
Published
2024-12-17
Title
Custom Dashboard Widget <= 1.0.0 - Reflected Cross-Site Scripting
Slug
create-db-tables
Published
2026-04-21
Title
Create DB Tables <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Table Creation/Deletion via admin-post.php
Slug
create-flipbook-from-pdf
Published
2024-10-09
Title
Creates 3D Flipbook, PDF Flipbook <= 1.2 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
create-posts-terms
Published
2025-10-27
Title
Create Posts & Terms <= 1.3.1 - Cross-Site Request Forgery
Slug
create-temporary-login
Published
2025-10-14
Title
WPBifröst – Instant Passwordless Temporary Login Links < 1.0.8 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Slug
create-with-code
Published
2025-01-24
Title
Create with Code < 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
creative-addons-for-elementor
Published
2024-04-01
Title
Creative Addons for Elementor < 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
creative-blocks
Published
2024-11-08
Title
Creative Blocks <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
creative-image-slider
Published
2024-03-28
Title
Creative Image Slider – Responsive Slider Plugin < 2.5.0 - Reflected Cross-Site Scripting
Slug
creative-mail-by-constant-contact
Published
2022-10-28
Title
Creative Mail < 1.6.0 - Multiple CSRF
Slug
creative-mail-by-constant-contact
Published
2022-10-28
Title
Creative Mail < 1.6.0 - Settings Reset via CSRF
Slug
creative-mail-by-constant-contact
Published
2022-10-28
Title
Creative Mail < 1.6.0 - CSRF
Slug
creative-mail-by-constant-contact
Published
2026-05-19
Title
Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi
Slug
creative-mail-by-constant-contact
Published
2026-07-28
Title
Creative Mail <= 1.6.9 - Subscriber+ SQLi
Slug
creatorlms
Published
2026-01-10
Title
Creator LMS < 1.1.13 - Missing Authorization
Slug
creatorlms
Published
2026-01-20
Title
Creator LMS – The LMS for Creators, Coaches, and Trainers < 1.1.13 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update
Slug
creatorlms
Published
2026-03-20
Title
Creator LMS < 1.1.19 - Contributor+ Privilege Escalation
Slug
creatorlms
Published
2026-09-29
Title
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators < 1.2.20 - Authenticated (Contributor+) Path Traversal
Slug
creatorlms
Published
2026-10-08
Title
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators < 1.2.22 - Missing Authorization
Slug
creatorlms
Published
2026-10-08
Title
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators < 1.2.22 - Authenticated (Contributor+) Arbitrary File Upload
Slug
creatorlms
Published
2026-09-30
Title
Creator LMS < 1.2.20 - Subscriber+ Payment Bypass via 'purchase_by' Parameter
Slug
creavi-booking-service
Published
2026-06-18
Title
Appointment Booking Calendar < 1.4.5 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label
Slug
cred-frontend-editor
Published
2026-06-25
Title
Toolset Forms < 2.6.25 - Unauthenticated Insecure Direct Object Reference
Slug
credit-tracker
Published
2023-11-28
Title
Credit Tracker <= 1.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting