WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
flog
Published
2014-04-25
Title
Flog <= 0.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Slug
florapress
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
florapress
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
flow-flow-social-streams
Published
2018-10-26
Title
Flow-Flow Social Stream <= 3.0.71 - Unauthenticated Cross-Site Scripting (XSS)
Slug
flow-flow-social-streams
Published
2025-12-11
Title
Flow-Flow Social Feed Stream 3.0.0 - 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via flow_flow_social_auth AJAX action
Slug
flowbox
Published
2025-12-31
Title
Flowbox <= 1.1.5 - Missing Authorization
Slug
flower-delivery-by-florist-one
Published
2022-06-02
Title
Flower Delivery by Florist One <= 3.9.1 - Admin+ Stored Cross-Site Scripting
Slug
flower-delivery-by-florist-one
Published
2024-12-03
Title
Flower Delivery by Florist One < 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
flowfact-wp-connector
Published
2023-11-08
Title
FLOWFACT WP Connector < 2.1.8 - Reflected XSS
Slug
flowforms
Published
2026-07-09
Title
FlowForms < 1.1.2 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoints
Slug
flowpaper-lite-pdf-flipbook
Published
2023-08-11
Title
Flowpaper < 2.0.0 - Contributor+ Stored XSS
Slug
flowpaper-lite-pdf-flipbook
Published
2023-09-26
Title
flowpaper < 2.0.4 - Contributor+ Stored XSS
Slug
flowplayer6-video-player
Published
2022-11-22
Title
Flowplayer Video Player < 1.0.5 - Contributor+ Stored XSS
Slug
fluent-boards
Published
2025-04-17
Title
FluentBoards < 1.48 - Unauthenticated PHP Object Injection
Slug
fluent-boards
Published
2026-01-22
Title
FluentBoards < 1.91.2 - Missing Authorization
Slug
fluent-boards
Published
2026-04-15
Title
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration < 1.91.3 - Authenticated (Board Member+) Insecure Direct Object Reference
Slug
fluent-booking
Published
2025-12-03
Title
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution < 1.10.0 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and Management
Slug
fluent-booking
Published
2025-11-25
Title
Fluent Booking < 1.10.0 - Missing Authorization
Slug
fluent-booking
Published
2026-03-25
Title
Fluent Booking < 2.0.05 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters
Slug
fluent-booking
Published
2026-06-09
Title
Fluent Booking < 2.1.2 - Calendar Manager+ Sensitive Information Disclosure via Attendee Export
Slug
fluent-booking
Published
2026-06-26
Title
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution < 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fluent-cart
Published
2025-12-02
Title
FluentCart A New Era of eCommerce < 1.3.2 - Authenticated (Administrator+) SQL Injection via 'groupKey' Parameter
Slug
fluent-cart
Published
2026-01-27
Title
FluentCart < 1.3.0 - Unauthenticated Stored Cross-Site Scripting
Slug
fluent-cart
Published
2026-07-07
Title
FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR
Slug
fluent-cart
Published
2026-07-13
Title
FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes