WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
canadian-nutrition-facts-label
Published
2025-12-05
Title
Canadian Nutrition Facts Label <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Nutrition Label Custom Post Type
Slug
canalplan-ac
Published
2025-01-16
Title
Canalplan <= 5.31 - Reflected Cross-Site Scripting
Slug
cancel-order-request-woocommerce
Published
2023-06-26
Title
Cancel order request WooCommerce < 1.3.3 - Admin+ Stored XSS
Slug
cancel-order-request-woocommerce
Published
2026-08-03
Title
Cancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions
Slug
candidate-application-form
Published
2015-07-12
Title
Candidate Application Form <= 1.3 - Unauthenticated Arbitrary File Download
Slug
candifly
Published
2025-01-06
Title
Candifly <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
canecto
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
canonical-attachments
Published
2025-04-09
Title
Canonical Attachments <= 1.8 - Unauthenticated Stored XSS
Slug
canto
Published
2020-11-30
Title
Canto < 3.0.9 - Unauthenticated Blind SSRF
Slug
canto
Published
2023-08-09
Title
Canto < 3.0.5 - Unauthenticated Remote File Inclusion
Slug
canto
Published
2024-02-12
Title
Canto < 3.0.7 - Unauthenticated RCE
Slug
canto
Published
2024-06-13
Title
Canto < 3.0.9 - Unauthenticated Remote File Inclusion
Slug
canto
Published
2026-03-20
Title
Canto < 3.1.2 - Missing Authorization to Unauthenticated File Upload
Slug
canto
Published
2026-04-16
Title
Canto < 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Setting Modification
Slug
canto-testimonials
Published
2026-01-23
Title
Canto Testimonials <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fx' Shortcode Attribute
Slug
canva
Published
2024-04-15
Title
Canva – Design beautiful blog graphics <= 1.2.4 - Reflected Cross-Site Scripting
Slug
canvas
Published
2026-06-12
Title
Canvas < 2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Block Attribute
Slug
canvasflow
Published
2025-01-10
Title
CanvasFlow <= 1.5.5 - Reflected XSS
Slug
canvasio3d-light
Published
2023-10-18
Title
Download canvasio3D Light <= 2.5.0 - Reflected XSS
Slug
canvasio3d-light
Published
2023-11-28
Title
Download canvasio3D Light <= 2.5.0 - Subscriber+ Entries Update/Deletion
Slug
canvasio3d-light
Published
2024-05-06
Title
canvasio3D Light <= 2.5.0 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
capa
Published
2022-05-30
Title
CaPa Protect <= 0.5.8.2 - Arbitrary Settings Update via CSRF
Slug
capabilities-pro
Published
2021-12-08
Title
PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise
Slug
capabilities-pro
Published
2022-10-10
Title
PublishPress Capabilities < 2.5.2 - Admin+ PHP Objection Injection
Slug
capability-manager-enhanced
Published
2018-09-25
Title
Capability Manager Enhanced <= 1.5.8 - Authenticated SQLi