WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
fusedesk
Published
2025-04-23
Title
FuseDesk < 6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via successredirect Parameter
Slug
fusewp
Published
2025-10-24
Title
FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) < 1.1.23.1 - Cross-Site Request Forgery to Sync Rule Creation
Slug
fusewp
Published
2025-10-30
Title
FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) < 1.1.23.1 - Missing Authorization to Authenticated (Subscriber+) Sync Rule Creation
Slug
fusion
Published
2024-07-10
Title
Fusion < 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion
Published
2025-03-31
Title
Fusion <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion-builder
Published
2022-04-19
Title
Fusion Builder < 3.6.2 - Unauthenticated SSRF
Slug
fusion-builder
Published
2023-08-10
Title
Fusion Builder < 3.11.2 - Cross Site Scripting (XSS) vulnerability in the User Register element
Slug
fusion-builder
Published
2024-09-12
Title
Avada | Website Builder For WordPress & eCommerce < 3.11.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode
Slug
fusion-builder
Published
2024-12-24
Title
Avada Builder < 3.11.13 - Authenticated (Contributor+) Protected Post Disclosure
Slug
fusion-builder
Published
2025-01-22
Title
Avada Builder < 3.11.12 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets
Slug
fusion-builder
Published
2025-02-12
Title
Avada Builder < 3.11.14 - Unauthenticated Arbitrary Shortcode Execution
Slug
fusion-builder
Published
2025-03-31
Title
Avada Builder < 3.11.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion-builder
Published
2025-07-15
Title
Avada (Fusion) Builder < 3.12.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
fusion-builder
Published
2025-10-03
Title
Fusion Builder < 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion-engage
Published
2015-04-10
Title
Fusion Engage 1.0.5 - Local File Disclosure
Slug
fusion-extension-gallery
Published
2025-09-22
Title
Fusion Page Builder : Extension - Gallery < 1.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion-slider
Published
2024-06-18
Title
Universal Slider <= 1.6.5 - Authenticated (Contributor+) PHP Object Injection
Slug
fusionspan-impexium-single-sign-on
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
fusionspan-impexium-single-sign-on
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
futurio-extra
Published
2022-01-04
Title
Futurio Extra < 1.6.3 - Authenticated SQL Injection
Slug
futurio-extra
Published
2022-01-14
Title
Futurio Extra < 1.6.3 - Subscriber+ User Email Address Disclosure
Slug
futurio-extra
Published
2023-08-11
Title
Futurio Extra < 1.9.1 - Arbitrary Plugin Activation via CSRF
Slug
futurio-extra
Published
2024-06-11
Title
Futurio Extra < 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Text Block Widget
Slug
futurio-extra
Published
2024-10-24
Title
Futurio Extra < 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
futurio-extra
Published
2024-11-11
Title
Futurio Extra < 2.0.14 - Authenticated (Contributor+) Post Disclosure