WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
dr-flex
Published
2025-03-27
Title
Dr. Flex < 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
dr-widgets-blocks
Published
2024-11-01
Title
Delisho < 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
dr-widgets-blocks
Published
2025-09-26
Title
Delisho < 1.1.4 - Missing Authorization
Slug
dracula-dark-mode
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
dracula-dark-mode
Published
2024-03-25
Title
Dracula Dark Mode - The Revolutionary Dark Mode Plugin For WordPress < 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Slug
dracula-dark-mode
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
draft-notify
Published
2025-12-21
Title
Draft Notify <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
drag-and-drop-custom-sidebar
Published
2025-01-16
Title
REAL WordPress Sidebar <= 0.1 - Unauthenticated Stored Cross-Site Scripting
Slug
drag-and-drop-file-upload-for-contact-form-7
Published
2026-04-23
Title
Drag and Drop File Upload for Contact Form 7 < 1.1.4 - Unauthenticated Arbitrary File Upload via sanitize_file_name Bypass
Slug
drag-and-drop-file-upload-for-elementor-forms
Published
2025-05-15
Title
Drag and Drop File Upload for Elementor Forms < 1.5.0 - Unauthenticated Arbitrary File Deletion
Slug
drag-and-drop-file-upload-for-elementor-forms
Published
2025-08-26
Title
Drag and Drop File Upload for Elementor Forms < 1.5.4 - Unauthenticated Arbitrary File Upload
Slug
drag-and-drop-file-upload-wc-pro
Published
2025-06-23
Title
Drag and Drop Multiple File Upload (Pro) - WooCommerce < 5.0.7 - Unauthenticated Arbitrary File Upload
Slug
drag-and-drop-file-uploads-wc-pro
Published
2025-07-01
Title
Drag and Drop Multiple File Upload (Pro) - WooCommerce < 5.0.7 and 5.0 - 5.0.5 - Unauthenticated Arbitrary File Upload
Slug
drag-and-drop-form-builder-for-contact-form-7
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
drag-and-drop-form-builder-for-contact-form-7
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
drag-and-drop-multiple-file-upload-contact-form-7
Published
2020-05-26
Title
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.3.3 - Unauthenticated File Upload Bypass
Slug
drag-and-drop-multiple-file-upload-contact-form-7
Published
2020-09-21
Title
Drag and Drop Multiple File Upload – Contact Form 7 < 1.3.5.5 - Unauthenticated Remote Code Execution
Slug
drag-and-drop-multiple-file-upload-contact-form-7
Published
2022-03-07
Title
Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS
Slug
drag-and-drop-multiple-file-upload-contact-form-7
Published
2022-09-26
Title
Drag and Drop Multiple File Upload < 1.3.6.5 - File Upload Size Limit Bypass
Slug
drag-and-drop-multiple-file-upload-contact-form-7
Published
2023-05-24
Title
Drag and Drop Multiple File Upload – Contact Form 7 < 1.3.6.6 - File Upload and File deletion via CSRF
Slug
drag-and-drop-multiple-file-upload-contact-form-7
Published
2023-11-01
Title
Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.7.4 - Unauthenticated Arbitrary File Upload
Slug
drag-and-drop-multiple-file-upload-contact-form-7
Published
2024-04-29
Title
Drag and Drop Multiple File Upload – Contact Form 7 < 1.3.7.8 - Sensitive Information Exposure
Slug
drag-and-drop-multiple-file-upload-contact-form-7
Published
2025-01-30
Title
Drag and Drop Multiple File Upload – Contact Form 7 < 1.3.8.6 - Limited Arbitrary File Deletion
Slug
drag-and-drop-multiple-file-upload-contact-form-7
Published
2025-03-27
Title
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.8.8 - Unauthenticated Arbitrary File Deletion
Slug
drag-and-drop-multiple-file-upload-contact-form-7
Published
2025-03-27
Title
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.8.9 - Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletion