WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
circular_countdown
Published
2025-05-16
Title
CountDown Pro WP Plugin <= 2.7 - Authenticated (Contributor+) SQL Injection
Slug
cision-block
Published
2025-05-05
Title
Cision Block < 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
Slug
citadela-directory
Published
2024-04-11
Title
Citadela Listing <= 5.18.1 - Unauthenticated Sensitive Information Exposure
Slug
citadela-directory
Published
2024-04-11
Title
Citadela Listing <= 5.18.1 - Cross-Site Request Forgery
Slug
citations-tools
Published
2026-02-13
Title
Citations tools <= 0.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'code' Shortcode Attribute
Slug
cities-shipping-zones-for-woocommerce
Published
2024-09-25
Title
Cities Shipping Zones for WooCommerce < 1.2.8 - Authenticated (Shop Manager+) Local File Inclusion
Slug
citizen-space
Published
2014-08-01
Title
Citizen Space 1.0 - Script Insertion CSRF
Slug
citizen-space
Published
2015-04-16
Title
Citizen Space <= 1.1 - Reflected Cross-Site Scripting (XSS)
Slug
cits-support-svg-webp-media-upload
Published
2023-10-09
Title
CITS Support svg, webp Media and TTF,OTF File Upload < 3.0 - Author+ Stored XSS via SVG
Slug
cits-support-svg-webp-media-upload
Published
2025-03-21
Title
CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts <= 4.2 - Cross-Site Request Forgery to Settings Update
Slug
cits-support-svg-webp-media-upload
Published
2025-03-21
Title
CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts <= 4.2 - Cross-Site Request Forgery to Font Assignment Deletion
Slug
civi-framework
Published
2025-06-06
Title
Civi Framework < 2.1.6.4 - Cross-Site Request Forgery
Slug
civic-cookie-control-8
Published
2025-12-30
Title
Civic Cookie Control < 1.54 - Missing Authorization
Slug
civicrm
Published
2021-06-22
Title
CiviCRM < 5.28.1 - CSRF to Stored XSS
Slug
civicrm
Published
2021-06-22
Title
CiviCRM < 5.24.3 - Authenticated Phar Deserialization
Slug
cj-change-howdy
Published
2024-10-14
Title
CJ Change Howdy <= 3.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
cj-custom-content
Published
2025-01-16
Title
CJ Custom Content <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
ck-and-syntaxhighlighter
Published
2024-12-12
Title
CK and SyntaxHighlighter <= 3.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
ckeditor-for-wordpress
Published
2015-08-31
Title
CKEditor for WordPress <= 4.5.3 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
claptastic-clap-button
Published
2016-03-28
Title
Claptastic clap! Button <= 1.3 - Authenticated Cross-Site Scripting (XSS)
Slug
clariti
Published
2025-09-22
Title
Clariti < 1.2.2 - Missing Authorization
Slug
clasifico-listing
Published
2026-02-18
Title
Clasifico Listing <= 2.0 - Unauthenticated Privilege Escalation
Slug
clasify-classified-listing
Published
2024-12-07
Title
Clasify Classified Listing <= 1.0.7 - Reflected XSS
Slug
claspo
Published
2025-12-17
Title
Claspo – Popups, Spin the Wheel & Email Capture < 1.0.8 - Missing Authorization
Slug
classic-addons-wpbakery-page-builder-addons
Published
2024-08-26
Title
Classic Addons – WPBakery Page Builder < 3.6 - Contributor+ Stored XSS