WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
community-events
Published
2025-10-08
Title
Community Events < 1.5.2 - Unauthenticated SQL Injection
Slug
community-events
Published
2025-10-31
Title
Community Events < 1.5.3 - Unauthenticated Stored Cross-Site Scripting
Slug
community-events
Published
2025-11-18
Title
Community Events < 1.5.5 - Unauthenticated SQL Injection
Slug
community-events
Published
2026-01-16
Title
Community Events < 1.5.7 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter
Slug
community-events
Published
2026-02-17
Title
Community Events < 1.5.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ce_venue_name' Parameter
Slug
community-events
Published
2026-03-06
Title
Community Events < 1.5.9 - Authenticated (Administrator+) SQL Injection via 'ce_venue_name' CSV Field
Slug
community-yard-sale
Published
2024-11-08
Title
Community Yard Sale <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
compact-admin
Published
2025-09-05
Title
Compact Admin <= 1.3.0 - Cross-Site Request Forgery
Slug
compact-archives
Published
2025-09-22
Title
Compact Archives < 4.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
compact-wp-audio-player
Published
2021-09-15
Title
Compact WP Audio Player < 1.9.7 - Setting Change via CSRF
Slug
compact-wp-audio-player
Published
2021-09-15
Title
Compact WP Audio Player < 1.9.7 - Contributor+ Stored Cross-Site Scripting
Slug
compact-wp-audio-player
Published
2022-12-27
Title
Compact WP Audio Player < 1.9.8 - Contributor+ Stored XSS
Slug
compact-wp-audio-player
Published
2024-03-25
Title
Compact WP Audio Player < 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via fileurl
Slug
compact-wp-audio-player
Published
2024-10-23
Title
Compact WP Audio Player < 1.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_embed_player Shortcode
Slug
compact-wp-audio-player
Published
2025-01-03
Title
Compact WP Audio Player < 1.9.15 - Authenticated (Contributor+) Server-Side Request Forgery
Slug
companion-auto-update
Published
2019-01-14
Title
Companion Auto Update <= 3.3.5 - Authenticated SQL Injection
Slug
companion-auto-update
Published
2018-10-02
Title
Companion Auto Update <= 3.2.0 - CSRF & LFI
Slug
companion-auto-update
Published
2025-07-14
Title
Companion Auto Update < 3.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via update_delay_days parameter
Slug
companion-portfolio
Published
2024-12-13
Title
Companion Portfolio – Responsive Portfolio Plugin <= 2.4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
companion-sitemap-generator
Published
2019-01-14
Title
Companion Sitemap Generator < 3.7.0 - CSRF
Slug
companion-sitemap-generator
Published
2023-02-20
Title
Companion Sitemap Generator < 4.5.3 - Contributor+ Stored XSS
Slug
companion-sitemap-generator
Published
2023-06-19
Title
Companion Sitemap Generator < 4.5.3 - Reflected XSS
Slug
company-updates-for-linkedin
Published
2022-06-21
Title
LinkedIn Company Updates <= 1.5.3 - Admin+ Stored Cross-Site Scripting
Slug
compare-affiliated-products
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
compare-affiliated-products
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting