WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
custom-user-css
Published
2024-01-03
Title
Custom User CSS <= 0.2 - Settings Update via CSRF
Slug
custom-user-guide
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
custom-user-guide
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
custom-users-order
Published
2025-01-16
Title
Custom Users Order <= 4.2 - Reflected Cross-Site Scripting
Slug
custom-welcome-guide
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
custom-welcome-guide
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
custom-widget-classes
Published
2025-01-16
Title
Custom Widget Classes <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
custom-widget-creator
Published
2025-01-16
Title
Custom Widget Creator <= 1.0.5 - Reflected Cross-Site Scripting
Slug
custom-word-cloud
Published
2025-08-01
Title
Custom Word Cloud <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via angle Parameter
Slug
custom-wp-rest-api
Published
2024-12-11
Title
Ultimate Endpoints With Rest Api <= 2.2.2 - Reflected Cross-Site Scripting
Slug
customcomment
Published
2025-08-17
Title
Custom Comment <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
customcomment
Published
2025-08-20
Title
Custom Comment <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
customer-area
Published
2017-11-22
Title
Customer Area < 7.4.3 - XSS
Slug
customer-area
Published
2023-01-17
Title
WP Customer Area < 8.1.4 - Unauthorised Actions via CSRF
Slug
customer-area
Published
2024-01-10
Title
WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak
Slug
customer-area
Published
2024-01-10
Title
WP Customer Area < 8.2.1 - Subscriber+ Account Address Update
Slug
customer-area
Published
2024-01-23
Title
WP Customer Area < 8.2.3 - Reflected Cross-Site Scripting
Slug
customer-area
Published
2025-01-06
Title
WP Customer Area < 8.2.5 - Bulk Delete via CSRF
Slug
customer-area
Published
2025-01-06
Title
WP Customer Area < 8.2.5 - Event Log Deletion via CSRF
Slug
customer-area
Published
2025-06-19
Title
WP Customer Area < 8.3.7 - Missing Authorization
Slug
customer-area
Published
2025-07-21
Title
Customer Area < 8.3.4 - Unauthenticated Local File Inclusion
Slug
customer-area
Published
2026-04-17
Title
WP Customer Area < 8.3.5 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file
Slug
customer-area
Published
2026-05-01
Title
WP Customer Area < 8.3.5 - Authenticated (Custom+) Path Traversal
Slug
customer-area
Published
2026-07-13
Title
WP Customer Area < 8.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
Slug
customer-area
Published
2026-10-30
Title
WP Customer Area < 8.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting