WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
checkout-gateway-iris
Published
2026-02-05
Title
Checkout Gateway for IRIS < 1.4 - Missing Authorization
Slug
checkout-mestres-wp
Published
2023-12-27
Title
Checkout Mestres WP < 7.1.9.8 - Missing Authorization to Unauthenticated Arbitrary Options Update
Slug
checkout-mestres-wp
Published
2023-12-27
Title
Checkout Mestres WP < 7.1.9.8 - Unauthenticated SQL Injection
Slug
checkout-mestres-wp
Published
2023-12-27
Title
Checkout Mestres WP < 7.1.9.8 - Authentication Bypass via Password Reset
Slug
checkout-mestres-wp
Published
2024-09-24
Title
Checkout Mestres WP < 8.6.1 - Authenticated (Admin+) Local File Inclusion
Slug
checkout-mestres-wp
Published
2025-03-28
Title
Checkout Mestres do WP for WooCommerce 8.6.5 - 8.7.5 - Unauthenticated Arbitrary Options Update
Slug
checkout-plugins-stripe-woo
Published
2023-02-28
Title
Stripe Payments For WooCommerce by Checkout < 1.4.11 - Settings Update via CSRF
Slug
checkout-plugins-stripe-woo
Published
2024-08-16
Title
Stripe Payments For WooCommerce by Checkout < 1.9.2 - Unauthenticated Insecure Direct Object Reference
Slug
checkout-plugins-stripe-woo
Published
2024-08-16
Title
Stripe Payments For WooCommerce by Checkout < 1.9.2 - Cross-Site Request Forgery
Slug
checkout-upsell-and-order-bumps
Published
2026-01-28
Title
UpsellWP < 2.2.6 - Missing Authorization
Slug
checkout-upsell-and-order-bumps
Published
2026-03-14
Title
UpsellWP – WooCommerce Upsell and Related Products Offers < 2.2.5 - Authenticated (Shop manager+) SQL Injection
Slug
checkout-upsell-and-order-bumps
Published
2026-09-16
Title
UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together
Slug
checkview
Published
2026-06-19
Title
CheckView – Form & Checkout Testing < 2.2.0 - Missing Authorization
Slug
checkview
Published
2026-08-07
Title
CheckView < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass
Slug
cheetaho-image-optimizer
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
cherry-plugin
Published
2016-06-22
Title
Cherry Plugin < 1.2.7 - Unauthenticated Arbitrary File Upload and Download
Slug
chessgame-shizzle
Published
2024-11-22
Title
Chessgame Shizzle < 1.3.1 - Reflected Cross-Site Scripting
Slug
chesstempoviewer
Published
2025-01-16
Title
Chess Tempo Viewer <= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
chikkili-google-pay-for-woocommerce
Published
2026-10-22
Title
Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature
Slug
chikuncount
Published
2014-08-01
Title
chikuncount - ofc_upload_image.php Arbitrary File Upload
Slug
child-height-predictor
Published
2026-05-19
Title
Child Height Predictor by Ostheimer <= 1.3 - Cross-Site Request Forgery to Settings Update via Plugin Settings Form
Slug
child-pages-card
Published
2026-07-31
Title
Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes
Slug
child-support-calculator
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
child-support-calculator
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
child-theme-generator
Published
2021-11-18
Title
Child Theme Generator <= 2.2.7 - Reflected Cross-Site Scripting