WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
ctl-arcade-lite
Published
2025-11-10
Title
CTL Arcade Lite <= 1.0 - Cross-Site Request Forgery to Plugin Activation and Deactivation
Slug
ctl-behance-importer-lite
Published
2025-09-11
Title
CTL Behance Importer Lite <= 1.0 - Unauthenticated SQL Injection
Slug
ctt-expresso-para-woocommerce
Published
2023-01-20
Title
CTT Expresso para WooCommerce < 3.2.12 - Admin+ Stored XSS
Slug
ctt-expresso-para-woocommerce
Published
2024-07-31
Title
CTT Expresso para WooCommerce < 3.2.13 - Information Exposure via Unprotected Directory
Slug
ctt-expresso-para-woocommerce
Published
2024-06-01
Title
CTT Expresso para WooCommerce < 3.2.13 - Admin+ Stored XSS
Slug
ctuser
Published
2025-06-25
Title
CTUsers <= 1.0.0 - Unauthenticated Local File Inclusion
Slug
cube-slider
Published
2022-05-09
Title
Cube Slider <= 1.2 - Admin+ SQLi
Slug
cubepm
Published
2025-01-16
Title
CubePM <= 1.0 - Reflected Cross-Site Scripting
Slug
cubepoints
Published
2025-06-05
Title
CubePoints <= 3.2.1 - Cross-Site Request Forgery
Slug
cubeportfolio
Published
2025-07-31
Title
Cube Portfolio <= 1.16.8 - Authenticated (Subscriber+) SQL Injection
Slug
cubewp-forms
Published
2024-09-24
Title
CubeWP Forms – All-in-One Form Builder < 1.1.2 - Unauthenticated Stored Cross-Site Scripting
Slug
cubewp-forms
Published
2025-01-06
Title
CubeWP Forms <= 1.1.10 - Missing Authorization
Slug
cubewp-forms
Published
2025-06-12
Title
CubeWP Forms < 1.1.6 - Missing Authorization
Slug
cubewp-framework
Published
2024-03-28
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.13 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
cubewp-framework
Published
2024-10-09
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.16 - Missing Authorization
Slug
cubewp-framework
Published
2025-06-10
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.24 - Authenticated (Subscriber+) Privilege Escalation
Slug
cubewp-framework
Published
2025-06-05
Title
CubeWP <= 1.1.29 - Cross-Site Request Forgery
Slug
cubewp-framework
Published
2025-06-12
Title
CubeWP Framework < 1.1.24 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
cubewp-framework
Published
2025-08-19
Title
CubeWP Framework < 1.1.25 - Subscriber+ Privilege Escalation
Slug
cubewp-framework
Published
2025-09-22
Title
CubeWP < 1.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
cubewp-framework
Published
2025-12-26
Title
CubeWP < 1.1.28 - Missing Authorization
Slug
cubewp-framework
Published
2026-01-16
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.28 - Unauthenticated Information Exposure
Slug
cubewp-framework
Published
2026-01-16
Title
CubeWP < 1.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode
Slug
cubewp-framework
Published
2026-01-24
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.28 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php
Slug
cue
Published
2025-04-01
Title
Cue < 2.4.5 - Missing Authorization