WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
custom-emails-for-woocommerce
Published
2025-05-19
Title
Additional Custom Emails & Recipients for WooCommerce < 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
custom-facebook-feed
Published
2021-08-16
Title
Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSS
Slug
custom-facebook-feed
Published
2021-10-29
Title
Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS
Slug
custom-facebook-feed
Published
2021-12-16
Title
Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
custom-facebook-feed
Published
2021-07-20
Title
Multiple Plugins from Smash Balloon - Reflected Cross-Site Scripting
Slug
custom-facebook-feed
Published
2022-12-20
Title
Smash Balloon Social Post Feed < 4.1.6 - Contributor+ Stored XSS
Slug
custom-facebook-feed
Published
2024-04-10
Title
Smash Balloon Social Post Feed < 4.2.2 - Facebook Token Reset/Update via CSRF
Slug
custom-facebook-feed
Published
2025-06-09
Title
Smash Balloon Custom Facebook Feed < 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute
Slug
custom-facebook-feed
Published
2025-10-09
Title
Smash Balloon Social Post Feed < 4.3.3 - Missing Authorization
Slug
custom-field-bulk-editor
Published
2024-03-29
Title
Custom Field Bulk Editor <= 1.9.1 - Reflected Cross-Site Scripting
Slug
custom-field-finder
Published
2024-04-25
Title
Custom field finder < 0.4 - Authenticated (Author+) PHP Object Injection
Slug
custom-field-for-wp-job-manager
Published
2023-07-24
Title
Custom Field For WP Job Manager < 1.2 - Admin+ Stored XSS
Slug
custom-field-for-wp-job-manager
Published
2023-07-13
Title
Custom Field For WP Job Manager < 1.2 - Admin+ Stored XSS
Slug
custom-field-for-wp-job-manager
Published
2024-08-15
Title
Custom Field For WP Job Manager < 1.3 - Insecure Direct Object Reference to Sensitive Information Exposure via Shortcode
Slug
custom-field-for-wp-job-manager
Published
2025-01-06
Title
Custom Field For WP Job Manager < 1.4 - Reflected Cross-Site Scripting
Slug
custom-field-for-wp-job-manager
Published
2025-03-27
Title
Custom Field For WP Job Manager < 1.5 - Cross-Site Request Forgery
Slug
custom-field-list-widget
Published
2025-03-17
Title
Custom Field List Widget <= 1.5.1 - Unauthenticated Local File Inclusion
Slug
custom-field-manager
Published
2024-11-22
Title
Custom Field Manager <= 1.0 - Reflected XSS Vulnerability
Slug
custom-field-suite
Published
2015-03-12
Title
Custom Field Suite <= 2.4 - Insufficient Authorisation
Slug
custom-field-suite
Published
2019-05-08
Title
Custom Field Suite <= 2.5.14 - Authenticated Cross-Site Scripting (XSS)
Slug
custom-field-suite
Published
2023-05-10
Title
Custom Field Suite < 2.6.3 - Admin+ Stored XSS
Slug
custom-field-suite
Published
2024-02-28
Title
Custom Field Suite < 2.6.5 - Authenticated (Admin+) Stored Cross-Site Scripting
Slug
custom-field-suite
Published
2024-05-07
Title
Custom Field Suite < 2.6.6 - Authenticated (Admin+) Stored Cross-Site Scripting
Slug
custom-field-suite
Published
2024-06-11
Title
Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_content]
Slug
custom-field-suite
Published
2024-06-19
Title
Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_title]