WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
ithemes
Published
2021-01-06
Title
iThemes Security < 7.7.0 - New-Password Requirements Not Enforced Until second Login
Slug
ithemes-exchange
Published
2015-04-20
Title
Multiple iThemes plugins, themes and add-ons - XSS via add_query_arg() and remove_query_arg()
Slug
ithemes-mobile
Published
2015-04-20
Title
Multiple iThemes plugins, themes and add-ons - XSS via add_query_arg() and remove_query_arg()
Slug
ithemes-security-pro
Published
2021-04-21
Title
iThemes Security Free (< 7.9.1) & Pro (< 6.8.4) - Hide Backend Bypass
Slug
ithemes-sync
Published
2019-10-09
Title
iThemes Sync <= 2.0.17 - Insufficient Secure Key Validation
Slug
ithemes-sync
Published
2023-08-25
Title
iThemes Sync < 2.1.14 - Cross-Site Request Forgery and Missing Authorization via 'hide_authenticate_notice'
Slug
ithemes-sync
Published
2023-11-07
Title
Solid Central < 3.0.1 - Stored Cross-Site Scripting via packages
Slug
ithoughts-advanced-code-editor
Published
2025-07-23
Title
iThoughts Advanced Code Editor <= 1.2.10 - Cross-Site Request Forgery to Settings Update
Slug
itwitter
Published
2014-12-19
Title
iTwitter <= 0.04 - XSS & CSRF
Slug
iubenda-cookie-law-solution
Published
2022-12-12
Title
iubenda < 3.3.3 - Subscriber+ Privileges Escalation to Admin
Slug
iva-business-hours-pro
Published
2021-04-02
Title
Business Hours Pro <= 5.5.0 - Unauthenticated Arbitrary File Upload to RCE
Slug
ivalt
Published
2024-10-09
Title
ivalt plugin contains malicious JS <= 1.0.0
Slug
iwant-one-ihave-one
Published
2014-08-01
Title
IWantOneButton 3.0.1 - Multiple Vulnerabilities
Slug
iwjob
Published
2025-03-06
Title
InWave Jobs <= 3.5.1 - Unauthenticated Privilege Escalation
Slug
iwjob
Published
2025-06-04
Title
InWave Jobs <= 3.5.8 - Missing Authorization
Slug
iworks-pwa
Published
2024-10-01
Title
PWA — easy way to Progressive Web App < 1.6.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
iwp-client
Published
2014-12-02
Title
InfiniteWP Client <= 1.3.7 - Privilege Escalation
Slug
iwp-client
Published
2015-07-08
Title
InfiniteWP Client <= 1.3.14 - Unspecified Critical
Slug
iwp-client
Published
2017-01-25
Title
InfiniteWP Client < 1.6.1.1 - Unauthenticated PHP Object Injection
Slug
iwp-client
Published
2020-01-14
Title
InfiniteWP Client < 1.9.4.5 - Authentication Bypass
Slug
iwp-client
Published
2023-08-14
Title
InfiniteWP Client < 1.12.1 - Unauthenticated Sensitive Information Exposure
Slug
iwp-client
Published
2024-02-08
Title
InfiniteWP Client < 1.12.3.1 - Unauthenticated Sensitive Information Exposure
Slug
iwp-client
Published
2025-01-07
Title
InfiniteWP Client < 1.13.1 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading
Slug
iws-geo-form-fields
Published
2022-11-30
Title
IWS - Geo Form Fields <= 1.0 - Unauthenticated SQLi
Slug
izeechat
Published
2015-05-14
Title
Multiple Plugins - jQuery prettyPhoto DOM Cross-Site Scripting (XSS)