WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
comments-like-dislike
Published
2023-08-16
Title
Comments Like Dislike < 1.2.0 - Subscriber+ Settings Reset
Slug
comments-not-replied-to
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
comments-not-replied-to
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
comments-on-feed
Published
2024-12-12
Title
Comments On Feed <= 1.2.1 - Reflected Cross-Site Scripting
Slug
comments-ratings
Published
2023-04-07
Title
Comments Ratings < 1.1.7 - Cross-Site Request Forgery
Slug
comments-ratings
Published
2023-10-16
Title
Comments Ratings <= 1.1.7 - Arbitrary Settings Update via CSRF
Slug
comments-ratings
Published
2023-11-03
Title
Comments Ratings <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
comments-secretary
Published
2025-12-11
Title
评论小秘书 <= 1.3.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Slug
comments-with-hypercommentscom
Published
2025-01-16
Title
HyperComments <= 0.9.6 - Reflected Cross-Site Scripting
Slug
commenttweets
Published
2023-12-10
Title
CommentTweets <= 0.6 - Settings Update via CSRF
Slug
commerce-coinbase-for-woocommerce
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
commerce-coinbase-for-woocommerce
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
commercial-real-estate-valuation-calculator
Published
2025-07-22
Title
Valuation Calculator < 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameter
Slug
common-ninja
Published
2025-01-06
Title
Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
common-tools-for-site
Published
2024-09-25
Title
Common Tools for Site <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
commons-booking
Published
2024-05-31
Title
CB (legacy) <= 0.9.4.18 - Admin+ Stored XSS
Slug
commons-booking
Published
2024-05-31
Title
CB (legacy) <= 0.9.4.18 - Code/Timeframe/Booking Deletion via CSRF
Slug
commonsbooking
Published
2022-02-21
Title
CommonsBooking < 2.6.8 - Unauthenticated SQL Injection
Slug
community-events
Published
2011-09-08
Title
Community Events < 1.2.3 - SQL Injection
Slug
community-events
Published
2015-04-14
Title
Community Events < 1.4 - SQL Injection
Slug
community-events
Published
2021-07-02
Title
Community Event < 1.4.8 - Reflected Cross-Site Scripting (XSS)
Slug
community-events
Published
2022-11-25
Title
Community Events < 1.4.9 - Admin+ Stored XSS
Slug
community-events
Published
2024-07-01
Title
Community Events < 1.5 - Event Deletion via CSRF
Slug
community-events
Published
2024-07-15
Title
Community Events < 1.5.1 - Admin+ Stored XSS
Slug
community-events
Published
2025-10-07
Title
Community Events < 1.5.2 - Unauthenticated SQL Injection