WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
codemonkeys-hipaa-forms
Published
2026-03-23
Title
CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass
Slug
codepen-embed-block
Published
2025-06-19
Title
CodePen Embed Block < 1.2.1 - Admin+ Stored XSS
Slug
codepen-embedded-pen-shortcode
Published
2024-07-10
Title
CodePen Embedded Pens Shortcode < 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
codepen-embedded-pen-shortcode
Published
2024-10-24
Title
CodePen Embedded Pens Shortcode < 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
codepeople-post-map
Published
2026-06-26
Title
CodePeople Post Map for Google Maps < 1.2.7 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta
Slug
codepeople-post-map
Published
2026-06-30
Title
CodePeople Post Map for Google Maps < 1.2.6 - Unauthenticated Stored Cross-Site Scripting
Slug
codepile
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
codepile
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
codepress-admin-columns
Published
2021-05-31
Title
Admin Columns Free < 4.3 & Pro < 5.5.1 - Admin+ Stored XSS in Label
Slug
codepress-admin-columns
Published
2021-05-31
Title
Admin Columns Free (< 4.3.2) & Pro (< 5.5.2) - Authenticated Stored Cross-Site Scripting (XSS) in Custom Field
Slug
codepress-admin-columns
Published
2026-06-05
Title
Admin Columns < 7.0.19 - Contributor+ PHP Object Injection to Remote Code Execution via Custom Field Meta Value
Slug
coder-elementor
Published
2025-12-10
Title
Coder for Elementor <= 1.0.13 - Missing Authorization
Slug
codescar-radio-widget
Published
2025-04-09
Title
Codescar Radio Widget <= 0.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
codesnips
Published
2024-11-08
Title
codeSnips <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
codestyling-localization
Published
2014-08-01
Title
Code Styling Localization < 1.99.20 - Cross Site Scripting
Slug
codestyling-localization
Published
2015-06-03
Title
Codestyling Localization <= 1.99.30 - Multiple CSRF
Slug
coding-blocks
Published
2025-12-11
Title
Coding Blocks <= 1.1.0 - Cross-Site Request Forgery to Settings Update
Slug
codistoconnect
Published
2025-12-03
Title
Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration - Powered by Codisto <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting
Slug
codistoconnect
Published
2026-01-15
Title
Omnichannel for WooCommerce <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting
Slug
coditor
Published
2020-09-22
Title
Coditor <= 1.1 - Arbitrary File Edition, Deletion and Internal Directory Listing in wp-content
Slug
codoc
Published
2024-07-10
Title
codoc < 0.9.52 - Reflected Cross-Site Scripting
Slug
cognito-forms
Published
2024-12-11
Title
Cognito Forms <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
Slug
coil-web-monetization
Published
2025-11-17
Title
Coil Web Monetization <= 2.0.2 - Cross-Site Request Forgery
Slug
coinbase-commerce-for-contact-form-7
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
coinbase-commerce-for-contact-form-7
Published
2026-05-11
Title
Coinbase Commerce for Contact Form 7 < 1.2.0 - Missing Authorization to Authenticated (Subscriber+) API Key Modification via 'cccf7_api_key' Parameter