WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
license-manager-for-woocommerce
Published
2025-04-10
Title
License Manager for WooCommerce < 3.0.10 - Reflected Cross-Site Scripting
Slug
license-manager-for-woocommerce
Published
2025-09-05
Title
License Manager for WooCommerce < 3.0.13 - Admin+ SQL Injection
Slug
lifeline-donation
Published
2024-06-19
Title
Lifeline Donation <= 1.2.6 - Authentication Bypass
Slug
lifepress
Published
2025-08-20
Title
LifePress < 2.2 - Missing Authorization
Slug
lifepress
Published
2026-01-22
Title
LifePress < 2.2.2 - Missing Authorization
Slug
lifepress
Published
2026-05-11
Title
LifePress <= 2.2.2 - Unauthenticated Stored Cross-Site Scripting via 'n' Parameter via lp_update_mds AJAX Action
Slug
lifterlms
Published
2019-09-09
Title
LifterLMS < 3.35.1 - Unauthenticated Options Import
Slug
lifterlms
Published
2020-03-31
Title
LifterLMS < 3.37.15 - Arbitrary File Writing
Slug
lifterlms
Published
2021-05-10
Title
LifterLMS < 4.21.1 - Reflected Cross-Site Scripting (XSS) via Coupon Code in Checkout
Slug
lifterlms
Published
2021-05-10
Title
LifterLMS < 4.21.1 - Authenticated Stored XSS in Edit Profile
Slug
lifterlms
Published
2021-05-17
Title
LifterLMS < 4.21.2 - Access Other Student Grades/Answers via IDOR
Slug
lifterlms
Published
2023-11-05
Title
LifterLMS < 7.5.0 - Authenticated(Administrator+) Directory Traversal to Arbitrary CSV File Deletion
Slug
lifterlms
Published
2024-02-27
Title
LifterLMS – WordPress LMS Plugin for eLearning < 7.5.2 - Missing Authorization via process_review
Slug
lifterlms
Published
2024-04-08
Title
LifterLMS < 7.5.1 - Cross-Site Request Forgery
Slug
lifterlms
Published
2024-06-04
Title
LifterLMS – WordPress LMS Plugin for eLearning < 7.6.3 - Authenticated (Contributor+) SQL Injection via Shortcode
Slug
lifterlms
Published
2024-09-05
Title
LifterLMS < 7.7.6 - Authenticated (Admin+) SQL Injection
Slug
lifterlms
Published
2024-12-17
Title
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 7.8.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
Slug
lifterlms
Published
2024-12-08
Title
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS
Slug
lifterlms
Published
2025-03-18
Title
LifterLMS < 8.0.2 - Missing Authorization to Unauthenticated Post Trashing
Slug
lifterlms
Published
2025-07-01
Title
LifterLMS < 8.0.7 - Unauthenticated SQL Injection
Slug
lifterlms
Published
2025-11-12
Title
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes - Various Versions - Authenticated (Student+) Privilege Escalation
Slug
lifterlms
Published
2026-04-10
Title
LifterLMS < 9.2.2 - Authenticated (Custom+) SQL Injection via 'order' Parameter
Slug
lifterlms-gateway-paypal
Published
2022-04-04
Title
LifterLMS PayPal < 1.4.0 - Reflected Cross-Site Scripting
Slug
light-messages
Published
2021-07-19
Title
Light Messages <= 1.0 - CSRF to Stored XSS
Slug
light-poll
Published
2024-07-15
Title
Light Poll <= 1.0.0 - Poll Answers Deletion via CSRF