WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
findall-listing
Published
2025-11-26
Title
FindAll Listing < 1.1 - Unauthenticated Privilege Escalation
Slug
findall-membership
Published
2025-11-26
Title
FindAll Membership < 1.1 - Authentication Bypass via Social Login
Slug
finpose
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
fintelligence-calculator
Published
2024-11-23
Title
Fintelligence Calculator <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fintelligence-calculator
Published
2025-10-02
Title
Fintelligence Calculator <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
firebase-authentication
Published
2026-08-20
Title
Firebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim
Slug
firebox
Published
2025-11-27
Title
FireBox < 3.1.1-free-free - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
firebox
Published
2026-06-17
Title
FireBox Popups < 3.1.8 - Unauthenticated Sensitive Information Exposure in 'form_id' Parameter
Slug
firebox
Published
2026-09-08
Title
FireBox < 3.1.11 - Authenticated (Author+) Remote Code Execution to Privilege Escalation
Slug
firebox
Published
2026-10-09
Title
FireBox < 3.1.14 - Authenticated (Author+) SQL Injection via FireBox Form Display Condition
Slug
firedrum-email-marketing
Published
2025-04-10
Title
FireDrum Email Marketing < 1.65 - Reflected Cross-Site Scripting
Slug
firestats
Published
2014-08-01
Title
Firestats - Remote Configuration File Download
Slug
firework-videos
Published
2024-11-04
Title
Firework Shoppable Live Video <= 6.3 - Reflected Cross-Site Scripting
Slug
first-comment-redirect
Published
2025-01-16
Title
First Comment Redirect <= 1.0.3 - Reflected Cross-Site Scripting
Slug
first-graders-toolbox
Published
2023-12-05
Title
1 click disable all < 1.0.2 - Plugins Deactivation via CSRF
Slug
first-order-discount-woocommerce
Published
2023-12-06
Title
First Order Discount Woocommerce < 1.22 - Discount Update via CSRF
Slug
firsth3tagadsense
Published
2025-04-09
Title
Sandwich Adsense <= 4.0.2 - Missing Authorization
Slug
fish-and-ships
Published
2024-10-03
Title
Fish and Ships < 1.6 - Reflected Cross-Site Scripting
Slug
fitness-calculators
Published
2021-04-14
Title
Fitness Calculators < 1.9.6 - Cross-Site Request Forgery to Cross-Site Scripting (XSS)
Slug
fitness-calculators
Published
2023-09-06
Title
Fitness calculators < 2.0.9 - Admin+ Stored XSS
Slug
fitness-trainer
Published
2023-03-06
Title
Multiple e-plugins - Subscriber+ Privilege Escalation
Slug
fitness-trainer
Published
2026-01-22
Title
Fitness Trainer <= 1.7.1 - Missing Authorization
Slug
fitvids-for-wordpress
Published
2025-12-04
Title
FitVids for WordPress <= 4.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Slug
five-minute-webshop
Published
2022-05-11
Title
Five Minute Webshop <= 1.3.2 - Admin+ SQLi via orderby
Slug
five-minute-webshop
Published
2022-05-09
Title
Five Minute Webshop <= 1.3.2 - Admin+ SQLi via id