WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
getwid
Published
2024-07-19
Title
Getwid – Gutenberg Blocks < 2.0.11 - Missing Authorization to Google API key update
Slug
getwid
Published
2024-11-19
Title
Getwid – Gutenberg Blocks < 2.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
getwid
Published
2024-12-03
Title
Multiple Plugins - Contributor+ DOM-Based Stored XSS via FancyBox JavaScript Library
Slug
getwid
Published
2025-09-22
Title
Getwid < 2.1.3 - Authenticated (Contributor+) Sensitive Information Exposure
Slug
getwid
Published
2026-09-15
Title
Getwid < 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'
Slug
getwid
Published
2026-10-09
Title
Getwid < 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'
Slug
getwid-megamenu
Published
2025-05-19
Title
Mega Menu Block < 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
getyourguide-ticketing
Published
2022-11-17
Title
GetYourGuide Ticketing < 1.0.4 - Admin+ Stored XSS
Slug
gf-add-on-by-click5
Published
2026-10-09
Title
click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update
Slug
gf-add-on-by-click5
Published
2026-10-09
Title
click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications
Slug
gf-block-ips
Published
2023-12-26
Title
Block IPs for Gravity Forms < 1.0.2 - Cross-Site Request Forgery
Slug
gf-bookings-premium
Published
2026-05-05
Title
Gravity Bookings < 2.6 - Unauthenticated SQL Injection via 'category_id' Parameter
Slug
gf-bookings-premium
Published
2026-06-24
Title
Gravity Forms Booking < 2.7.2 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'
Slug
gf-bookings-premium
Published
2026-08-17
Title
Gravity Bookings <= 2.1 - Authenticated (Subscriber+) SQL Injection
Slug
gf-constant-contact
Published
2021-08-26
Title
Multiple Plugins from CRM Perks - Reflected Cross-Site Scripting
Slug
gf-constant-contact
Published
2025-06-05
Title
WP Gravity Forms Constant Contact Plugin < 1.1.1 - Open Redirect
Slug
gf-constant-contact
Published
2025-08-08
Title
Gravity Forms Constant Contact < 1.1.3 - Unauthenticated PHP Object Injection
Slug
gf-custom-style
Published
2024-09-25
Title
GF Custom Style <= 2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
gf-dynamics-crm
Published
2021-08-26
Title
Multiple Plugins from CRM Perks - Reflected Cross-Site Scripting
Slug
gf-dynamics-crm
Published
2025-05-07
Title
WP Gravity Forms Dynamics CRM < 1.1.5 - Open Redirect
Slug
gf-entries-in-excel
Published
2026-09-28
Title
GravityExport Lite for Gravity Forms < 2.7.3 - Missing Authorization
Slug
gf-excel-import
Published
2025-01-20
Title
Import Excel to Gravity Forms < 1.18.1 - Reflected Cross-Site Scripting
Slug
gf-freshdesk
Published
2021-08-26
Title
Multiple Plugins from CRM Perks - Reflected Cross-Site Scripting
Slug
gf-freshdesk
Published
2025-11-18
Title
Gravity Forms FreshDesk < 1.3.6 - Unauthenticated Open Redirect
Slug
gf-freshdesk
Published
2025-08-09
Title
Gravity Forms FreshDesk < 1.3.6 - Unauthenticated PHP Object Injection