WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
hot-random-image
Published
2024-03-25
Title
Hot Random Image < 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
hot-random-image
Published
2025-05-21
Title
Hot Random Image < 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameter
Slug
hot-random-image
Published
2025-05-21
Title
Hot Random Image < 1.9.3 - Path Traversal to Authenticated (Contributor+) Limited Arbitrary Image Access via path Parameter
Slug
hotel-listing
Published
2021-10-28
Title
Hotel Listing < 1.3.3 - Authenticated Stored Cross-Site Scripting
Slug
hotel-listing
Published
2023-03-06
Title
Multiple e-plugins - Subscriber+ Privilege Escalation
Slug
hotel-listing
Published
2025-08-30
Title
Hotel Listing <= 1.4.0 - Subscriber+ Privilege Escalation
Slug
hotel-listing
Published
2025-12-31
Title
Hotel Listing <= 1.4.0 - Reflected Cross-Site Scripting
Slug
hotel-listing
Published
2026-01-22
Title
Hotel Listing <= 1.4.2 - Missing Authorization
Slug
hotel-listing
Published
2026-01-22
Title
Hotel Listing <= 1.4.2 - Missing Authorization
Slug
hotelrunner
Published
2025-09-26
Title
HotelRunner Booking Widget <= 1.6 - Cross-Site Request Forgery
Slug
hotelrunner
Published
2025-11-20
Title
HotelRunner Booking Widget <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
hotjar
Published
2023-10-05
Title
Hotjar < 1.0.16 - Admin+ Stored XSS
Slug
hotjar-connecticator
Published
2021-05-04
Title
Hotjar Connecticator <= 1.1.1 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
hotjar-connecticator
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
hotlink2watermark
Published
2024-11-22
Title
Hotlink2Watermark <= 0.3.2 - Cross-Site Request Forgery
Slug
hotscot-contact-form
Published
2021-05-13
Title
Hotscot Contact Form < 1.3 - Admin+ SQL Injection
Slug
hotspots
Published
2025-01-16
Title
Hotspots Analytics <= 4.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
house-manager
Published
2024-07-16
Title
House Manager <= 1.0.8.4 - Reflected XSS
Slug
houzez-crm
Published
2024-07-08
Title
Houzez CRM < 1.4.3 - Authenticated (Seller+) SQL Injection
Slug
houzez-crm
Published
2025-08-27
Title
Houzez CRM < 1.5.0 - Missing Authorization
Slug
houzez-login-register
Published
2024-09-17
Title
Houzez Login Register < 3.3.0 - Subscriber+ Privilege Escalation via Account Takeover
Slug
houzez-login-register
Published
2023-02-23
Title
Houzez Login Register < 2.6.4 - Unauthenticated Privilege Escalation
Slug
houzez-property-feed
Published
2025-02-11
Title
Houzez Property Feed < 2.4.22 - Cross-Site Request Forgery to Property Feed Export Deletion
Slug
houzez-property-feed
Published
2025-03-29
Title
Houzez Property Feed < 2.5.5 - Unauthenticated Arbitrary File Download
Slug
houzez-theme-functionality
Published
2024-07-08
Title
Houzez Theme - Functionality < 3.2.3 - Authenticated (Seller+) SQL Injection