WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
html5-video-player
Published
2024-08-16
Title
Flash & HTML5 Video < 2.5.31 - Missing Authorization
Slug
html5-video-player
Published
2024-09-10
Title
HTML5 Video Player – mp4 Video Player Plugin and Block < 2.5.35 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
Slug
html5-video-player
Published
2024-09-10
Title
HTML5 Video Player – mp4 Video Player Plugin and Block < 2.5.33 - Missing Authorization in multiple functions via h5vp_ajax_handler
Slug
html5-video-player
Published
2025-01-13
Title
HTML5 Video Player – mp4 Video Player Plugin and Block < 2.5.36 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via heading Parameter
Slug
html5-video-player
Published
2026-06-26
Title
HTML5 Video Player – Embed and Play Videos in Custom Player < 2.11.1 - Missing Authorization
Slug
html5-video-player
Published
2026-10-29
Title
HTML5 Video Player – embed fast, responsive videos with ease < 2.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
html5-video-player-with-playlist
Published
2025-04-09
Title
HTML5 Video Player with Playlist <= 2.50 - Reflected Cross-Site Scripting
Slug
html5-videogallery-plus-player
Published
2026-04-13
Title
Multiple Plugins by "Essential Plugin" - Backdoor
Slug
html5-virtual-classroom
Published
2023-11-29
Title
BrainCert – HTML5 Virtual Classroom < 2.2 - Reflected Cross-Site Scripting
Slug
html5avmanager
Published
2014-08-01
Title
HTML5 AV Manager 0.2.7 - Arbitrary File Upload
Slug
http-auth
Published
2023-07-26
Title
HTTP Auth < 1.0.0 - Settings Update via CSRF
Slug
http-headers
Published
2023-04-24
Title
HTTP Headers < 1.18.8 - Admin+ SQL Injection
Slug
http-headers
Published
2023-06-19
Title
HTTP Headers < 1.18.11 - Admin+ Remote Code Execution
Slug
http-headers
Published
2023-07-13
Title
HTTP Headers < 1.19.0 - Admin+ SSRF
Slug
http-headers
Published
2023-07-10
Title
HTTP Headers < 1.19.0 - Admin+ Stored XSS
Slug
http-headers
Published
2026-04-21
Title
HTTP Headers < 1.19.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Headers' Plugin Setting
Slug
http-headers
Published
2026-04-21
Title
HTTP Headers < 1.19.3 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters
Slug
http-headers
Published
2026-04-21
Title
HTTP Headers <= 1.19.5 - Administrator+ CRLF Injection via Custom Header Values
Slug
http-https-remover
Published
2023-07-27
Title
Multiple Plugins from Inisev - Subscriber+ Plugin Installation
Slug
http-https-remover
Published
2023-07-27
Title
Multiple Plugins from Inisev - Plugin Installation via CSRF
Slug
http-requests-manager
Published
2026-10-05
Title
HTTP Requests Manager < 1.3.12 - Unauthenticated Stored Cross-Site Scripting
Slug
https-links-in-content
Published
2025-01-16
Title
HTTP to HTTPS link changer by Eyga.net <= 0.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
https-redirection
Published
2026-10-13
Title
Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite
Slug
https://github.com/placetopay/woocommerce-gateway-placetopay
Published
2026-07-16
Title
WooCommerce Placetopay Gateway <= 3.2.2 - Reflected Cross-Site Scripting via 'redirect-url'
Slug
hub-core
Published
2025-11-09
Title
Hub Core < 6.0.2 - Contributor+ Local File Inclusion