WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
how-to-wp
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
hpbseo
Published
2025-07-15
Title
hpb seo plugin for WordPress <= 3.0.1 - Reflected Cross-Site Scripting
Slug
hpbtool
Published
2022-05-09
Title
HPB Dashboard <= 1.3.1 - Admin+ Stored Cross Site Scripting
Slug
hq-rental-software
Published
2024-12-11
Title
HQ Rental Software <= 1.5.29 - Cross-Site Request Forgery to Arbitrary Options Update
Slug
hq60-fidelity-card
Published
2024-11-04
Title
HQ60 Fidelity Card <= 1.8 - Reflected Cross-Site Scripting
Slug
hqtheme-extra
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
hqtheme-extra
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
hr-management
Published
2024-08-12
Title
Crew HRM < 1.1.2 - Unauthenticated PHP Object Injection
Slug
hr-management-lite
Published
2025-06-05
Title
HR Management Lite <= 3.5 - Cross-Site Request Forgery
Slug
hr-management-lite
Published
2025-12-28
Title
HR Management Lite <= 3.5 - Missing Authorization
Slug
hr-press-lite
Published
2026-03-20
Title
Hr Press Lite <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Employee Information Exposure
Slug
hreflang-manager-lite
Published
2023-11-14
Title
Hreflang Manager < 1.07 - Cross-Site Request Forgery
Slug
hrm
Published
2019-02-23
Title
WP Human Resource Management <= 2.2.5 - Multiple Issues
Slug
hrm
Published
2025-07-03
Title
WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Arbitrary User Deletion via ajax_delete_employee Function
Slug
hrm
Published
2025-07-03
Title
WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation via wp_ajax_hrm_insert_employee AJAX Action
Slug
hs-brand-logo-slider
Published
2020-10-21
Title
Helios Solutions Brand Logo Slider <= 2.1 - Authenticated Arbitrary File Upload
Slug
hslide
Published
2025-03-04
Title
Hero Slider - WordPress Slider Plugin <= 1.3.5 - Authenticated (Subscriber+) SQL Injection
Slug
hss-embed-streaming-video
Published
2025-01-16
Title
HSS Embed Streaming Video <= 3.23 - Reflected Cross-Site Scripting
Slug
ht-builder
Published
2024-11-01
Title
HT Builder – WordPress Theme Builder for Elementor < 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
ht-contactform
Published
2023-02-28
Title
Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks < 1.1.6 - Arbitrary Plugin Activation via CSRF
Slug
ht-contactform
Published
2025-01-24
Title
HT Conctact Form 7 < 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
ht-contactform
Published
2025-07-14
Title
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. < 2.2.2 - Unauthenticated Arbitrary File Deletion
Slug
ht-contactform
Published
2025-07-14
Title
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. < 2.2.2 - Directory Traversal to Arbitrary File Move
Slug
ht-contactform
Published
2025-07-14
Title
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. < 2.2.2 - Unauthenticated Arbitrary File Upload
Slug
ht-contactform
Published
2025-07-16
Title
HT Contact Form 7 < 2.1.0 - Authenticated (Administrator+) Local File Inclusion