WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
csv-to-html
Published
2024-12-11
Title
CSV to html < 3.15 - Reflected Cross-Site Scripting
Slug
csv-to-sorttable
Published
2025-11-17
Title
CSV to SortTable <= 4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
csv-to-sorttable
Published
2025-11-18
Title
CSV to SortTable <= 4.2 - Contributor+ LFI
Slug
csv-wc-product-import-export
Published
2024-10-14
Title
CSV Product Import Export for WooCommerce <= 1.0.0 - Authenticated (Subscriber+) SQL Injection
Slug
csv2wpec-coupon
Published
2015-09-14
Title
Csv2WPeC Coupon <= 1.1 - Unauthenticated Remote File Upload
Slug
ct-commerce
Published
2023-09-06
Title
CT Commerce <= 2.0.1 - Admin+ Stored XSS
Slug
ct-real-estate-core
Published
2025-03-31
Title
Contempo Real Estate Core < 3.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
ct-ultimate-gdpr
Published
2021-02-05
Title
Ultimate GDPR & CCPA Compliance Toolkit < 2.5 - Unauthenticated Plugin Settings Export and Import
Slug
cta
Published
2015-02-02
Title
WordPress Calls to Action <= 2.2.7 - Stored XSS
Slug
cta
Published
2015-10-21
Title
WordPress Calls to Action < 2.5.1 - Reflected Cross-Site Scripting (XSS)
Slug
ctabs
Published
2025-03-24
Title
cTabs <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
ctl-arcade-lite
Published
2025-11-10
Title
CTL Arcade Lite <= 1.0 - Cross-Site Request Forgery to Plugin Activation and Deactivation
Slug
ctl-behance-importer-lite
Published
2025-09-11
Title
CTL Behance Importer Lite <= 1.0 - Unauthenticated SQL Injection
Slug
ctt-expresso-para-woocommerce
Published
2023-01-20
Title
CTT Expresso para WooCommerce < 3.2.12 - Admin+ Stored XSS
Slug
ctt-expresso-para-woocommerce
Published
2024-07-31
Title
CTT Expresso para WooCommerce < 3.2.13 - Information Exposure via Unprotected Directory
Slug
ctt-expresso-para-woocommerce
Published
2024-06-01
Title
CTT Expresso para WooCommerce < 3.2.13 - Admin+ Stored XSS
Slug
ctuser
Published
2025-06-25
Title
CTUsers <= 1.0.0 - Unauthenticated Local File Inclusion
Slug
cube-slider
Published
2022-05-09
Title
Cube Slider <= 1.2 - Admin+ SQLi
Slug
cubepm
Published
2025-01-16
Title
CubePM <= 1.0 - Reflected Cross-Site Scripting
Slug
cubepoints
Published
2025-06-05
Title
CubePoints <= 3.2.1 - Cross-Site Request Forgery
Slug
cubeportfolio
Published
2025-07-31
Title
Cube Portfolio <= 1.16.8 - Authenticated (Subscriber+) SQL Injection
Slug
cubewp-forms
Published
2024-09-24
Title
CubeWP Forms – All-in-One Form Builder < 1.1.2 - Unauthenticated Stored Cross-Site Scripting
Slug
cubewp-forms
Published
2025-01-06
Title
CubeWP Forms <= 1.1.10 - Missing Authorization
Slug
cubewp-forms
Published
2025-06-12
Title
CubeWP Forms < 1.1.6 - Missing Authorization
Slug
cubewp-framework
Published
2024-03-28
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.13 - Authenticated (Subscriber+) Arbitrary File Upload