WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
cornerstone
Published
2024-04-26
Title
Cornerstone < 0.8.1 - Reflected Cross-Site Scripting
Slug
cornerstone
Published
2025-10-06
Title
Cornerstone <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
cornerstone
Published
2026-06-03
Title
Themeco Cornerstone < 7.8.9 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Meta Disclosure
Slug
cornerstone
Published
2026-06-03
Title
Themeco Cornerstone < 7.8.8 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Password Hash Disclosure
Slug
cornerstone
Published
2026-06-04
Title
Cornerstone < 7.8.8 - Authenticated (Subscriber+) Arbitrary Code Execution
Slug
cornerstone
Published
2026-06-16
Title
Cornerstone < 7.8.8 - Authenticated (Subscriber+) SQL Injection
Slug
corona-virus-covid-19-banner
Published
2022-10-24
Title
Corona Virus (COVID-19) Banner & Live Data < 1.8.0 - CSRF
Slug
corona-virus-covid-19-banner
Published
2024-05-06
Title
Corona Virus (COVID-19) Banner & Live Data <= 1.8.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
coronavirus-covid-19-notice-message
Published
2025-02-18
Title
Coronavirus (COVID-19) Notice Message <= 1.1.2 - Admin+ Stored XSS
Slug
coronavirus-data-widgets
Published
2025-01-16
Title
Coronavirus (COVID-19) Outbreak Data Widgets <= 1.1.1 - Reflected Cross-Site Scripting
Slug
correct-prices
Published
2026-05-19
Title
Correct Prices <= 1.0 - Reflected Cross-Site Scripting via PHP_SELF Parameter
Slug
correos-express
Published
2021-11-29
Title
CorreosExpress <= 2.6.0 - Sensitive Information Disclosure
Slug
correosoficial
Published
2023-01-31
Title
Correos Oficial < 1.3.0.3 - Unauthenticated Arbitrary File Download
Slug
coru-lfmember
Published
2022-04-27
Title
Coru LFMember <= 1.0.2 - Arbitrary Game Deletion/Activation via CSRF
Slug
coru-lfmember
Published
2022-04-26
Title
Coru LFMember <= 1.0.2 - Stored Cross-Site Scripting via CSRF
Slug
corvuspay-woocommerce-integration
Published
2026-06-23
Title
CorvusPay WooCommerce Payment Gateway < 2.7.5 - Missing Authorization
Slug
corvuspay-woocommerce-integration
Published
2026-07-08
Title
CorvusPay WooCommerce Payment Gateway < 2.7.5 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter
Slug
corvuspay-woocommerce-integration
Published
2026-07-08
Title
CorvusPay WooCommerce Payment Gateway < 2.7.5 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint
Slug
corvuspay-woocommerce-integration
Published
2026-07-10
Title
CorvusPay WooCommerce Payment Gateway < 2.7.5 - Unauthenticated Stored Cross-Site Scripting via 'approval_code' Parameter
Slug
coschedule-by-todaymade
Published
2023-04-13
Title
CoSchedule < 3.3.9 - CSRF
Slug
coschedule-by-todaymade
Published
2025-09-26
Title
CoSchedule < 3.4.0 - Unauthenticated Sensitive Information Exposure
Slug
coschedule-by-todaymade
Published
2025-11-04
Title
CoSchedule < 3.4.1 - Missing Authorization
Slug
coschool
Published
2024-12-11
Title
CoSchool LMS <= 1.4.3 - Missing Authorization to Privilege Escalation
Slug
coschool
Published
2025-07-07
Title
CoSchool LMS <= 1.4.3 - Unauthenticated PHP Object Injection
Slug
coschool
Published
2025-07-14
Title
CoSchool LMS <= 1.4.3 - Authenticated (Subscriber+) SQL Injection