WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
custom-css-editor
Published
2025-10-08
Title
Custom CSS <= 1.4.0 - Missing Authorization
Slug
custom-css-js
Published
2017-07-24
Title
Simple Custom CSS and JS <= 3.3 - Authenticated Cross-Site Scripting (XSS)
Slug
custom-css-js-php
Published
2021-06-08
Title
CSRF Bypass in Multiple Plugins
Slug
custom-css-js-php
Published
2021-06-08
Title
Custom CSS, JS & PHP <= 2.0.7 - Arbitrary Settings Update via CSRF
Slug
custom-css-js-php
Published
2026-04-20
Title
Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE
Slug
custom-css-pro
Published
2019-06-24
Title
Custom CSS Pro <= 1.0.3 - CSRF & XSS
Slug
custom-dash
Published
2024-06-05
Title
Custom Dash <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
custom-dashboard-page
Published
2025-03-11
Title
Custom Dashboard Page <= 1.0 - Cross-Site Request Forgery
Slug
custom-dashboard-widgets
Published
2024-01-16
Title
Custom Dashboard Widgets <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via cdw_DashboardWidgets
Slug
custom-database-applications-by-caspio
Published
2025-03-31
Title
Custom Database Applications by Caspio <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
custom-database-tables
Published
2025-01-07
Title
Custom DataBase Tables <= 2.1.34 - Reflected Cross-Site Scripting
Slug
custom-email-options
Published
2022-04-11
Title
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Slug
custom-emails-for-woocommerce
Published
2025-05-19
Title
Additional Custom Emails & Recipients for WooCommerce < 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
custom-facebook-feed
Published
2021-08-16
Title
Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSS
Slug
custom-facebook-feed
Published
2021-10-29
Title
Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS
Slug
custom-facebook-feed
Published
2021-12-16
Title
Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
custom-facebook-feed
Published
2021-07-20
Title
Multiple Plugins from Smash Balloon - Reflected Cross-Site Scripting
Slug
custom-facebook-feed
Published
2022-12-20
Title
Smash Balloon Social Post Feed < 4.1.6 - Contributor+ Stored XSS
Slug
custom-facebook-feed
Published
2024-04-10
Title
Smash Balloon Social Post Feed < 4.2.2 - Facebook Token Reset/Update via CSRF
Slug
custom-facebook-feed
Published
2025-06-09
Title
Smash Balloon Custom Facebook Feed < 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute
Slug
custom-facebook-feed
Published
2025-10-09
Title
Smash Balloon Social Post Feed < 4.3.3 - Missing Authorization
Slug
custom-facebook-feed
Published
2026-08-15
Title
Smash Balloon Social Post Feed < 4.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Slug
custom-field-bulk-editor
Published
2024-03-29
Title
Custom Field Bulk Editor <= 1.9.1 - Reflected Cross-Site Scripting
Slug
custom-field-finder
Published
2024-04-25
Title
Custom field finder < 0.4 - Authenticated (Author+) PHP Object Injection
Slug
custom-field-for-wp-job-manager
Published
2023-07-24
Title
Custom Field For WP Job Manager < 1.2 - Admin+ Stored XSS