WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
convertforce-popup-builder
Published
2026-01-09
Title
ConvertForce Popup Builder < 0.0.8 - Stored Cross-Site Scripting via entrance_animation
Slug
convertful
Published
2023-10-24
Title
Convertful – Your Ultimate On-Site Conversion Tool < 2.6 - Missing Authorization via add_woo_coupon
Slug
convertkit
Published
2022-12-23
Title
ConvertKit < 2.0.5 - Contributor+ Stored XSS
Slug
convertkit
Published
2023-05-15
Title
ConvertKit < 2.2.1 - Reflected XSS
Slug
convertkit
Published
2024-04-05
Title
ConvertKit < 2.4.6 - Unauthenticated Sensitive Information Exposure
Slug
convertkit
Published
2024-06-20
Title
ConvertKit < 2.4.9.1 - Missing Authorization
Slug
convertkit
Published
2026-07-22
Title
Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages < 3.3.6 - Missing Authorization
Slug
convertkit
Published
2026-10-16
Title
Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages < 3.4.7 - Missing Authorization
Slug
convertkit
Published
2026-10-29
Title
Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership < 3.4.8 - Missing Authorization
Slug
convertkit-for-woocommerce
Published
2026-07-02
Title
Kit (formerly ConvertKit) for WooCommerce < 2.1.7 - Unauthenticated Information Exposure
Slug
convertkit-for-woocommerce
Published
2026-10-05
Title
Kit (formerly ConvertKit) for WooCommerce < 2.2.1 - Missing Authorization
Slug
convertplug
Published
2019-05-29
Title
ConvertPlus <= 3.4.2 - Unauthenticated Arbitrary User Role Creation
Slug
convertplug
Published
2019-06-07
Title
ConvertPlus <= 3.4.4 - Multiple Issues
Slug
convertplug
Published
2024-05-03
Title
ConvertPlug < 3.5.26 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
Slug
convertplug
Published
2024-05-03
Title
ConvertPlug < 3.5.26 - Authenticated (Contributor+) PHP Object Injection
Slug
convertplug
Published
2024-05-15
Title
ConvertPlus < 3.5.26.1 - Authenticated (Contributor+) PHP Object Injection
Slug
convertplug
Published
2025-02-11
Title
Popup Plugin For WordPress - ConvertPlus < 3.5.31 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
Slug
convertplug
Published
2026-09-28
Title
ConvertPlus < 3.6.4 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter
Slug
convertpro
Published
2025-12-31
Title
EasyTest < 1.0.2 - Missing Authorization
Slug
convertpro
Published
2026-08-18
Title
EasyTest – Simplify A/B Testing < 1.0.2 - Unauthenticated Stored Cross-Site Scripting
Slug
conveythis-translate
Published
2024-04-10
Title
Language Translate Widget for WordPress – ConveyThis < 224 - Unauthenticated Stored Cross-Site Scripting via api_key
Slug
conveythis-translate
Published
2024-07-22
Title
Language Translate Widget for WordPress – ConveyThis < 235 - Missing Authorization to Limited Option Update
Slug
conveythis-translate
Published
2025-09-22
Title
Translate WordPress with ConveyThis < 269.2 - Admin+ PHP Object Injection
Slug
conveythis-translate
Published
2025-11-29
Title
ConveyThis < 269.3 - Missing Authorization
Slug
conveythis-translate
Published
2026-01-27
Title
ConveyThis < 270.5 - Missing Authorization