WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
locations-and-areas
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
locatoraid
Published
2023-02-14
Title
Locatoraid Store Locator < 3.9.12 - CSRF
Slug
locatoraid
Published
2023-04-17
Title
Locatoraid Store Locator < 3.9.15 - Contributor+ Stored Cross-Site Scripting
Slug
locatoraid
Published
2023-05-11
Title
Locatoraid Store Locator < 3.9.19 - Subscriber+ Stored XSS
Slug
locatoraid
Published
2023-08-28
Title
Locatoraid Store Locator < 3.9.24 - Reflected XSS
Slug
locatoraid
Published
2024-03-25
Title
Locatoraid Store Locator < 3.9.31 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
locatoraid
Published
2024-10-15
Title
Locatoraid Store Locator < 3.9.48 - Reflected Cross-Site Scripting
Slug
locatoraid
Published
2025-01-03
Title
Locatoraid Store Locator < 3.9.51 - Unauthenticated PHP Object Injection
Slug
locatoraid
Published
2025-12-31
Title
Locatoraid Store Locator <= 3.9.65 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
lock-my-bp
Published
2022-04-11
Title
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Slug
lock-my-bp
Published
2025-12-15
Title
Wbcom Designs < 2.1.2 - Missing Authorization
Slug
lock-user-account
Published
2023-08-21
Title
Lock User Account < 1.0.4 - Arbitrary Account Lock/Unlock via CSRF
Slug
lock-user-account
Published
2024-11-20
Title
Lock User Account <= 1.0.5 - User Lock Bypass
Slug
lock-your-updates
Published
2025-04-09
Title
Lock Your Updates <= 1.1 - Reflected Cross-Site Scripting
Slug
locked-payment-methods-for-woocommerce
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
locked-payment-methods-for-woocommerce
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
locker-content
Published
2025-11-24
Title
Locker Content < 1.0.1 - Unauthenticated Information Exposure
Slug
lockerpress-wordpress-security
Published
2025-09-29
Title
LockerPress – WordPress Security Plugin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
lockets
Published
2025-01-16
Title
Lockets <= 0.999 - Reflected Cross-Site Scripting
Slug
loco-translate
Published
2019-03-27
Title
Loco Translate < 2.2.2 - Authenticated LFI
Slug
loco-translate
Published
2021-10-11
Title
Loco Translate < 2.5.4 - Authenticated PHP Code Injection
Slug
loco-translate
Published
2022-03-22
Title
Loco Translate < 2.6.1 - Authenticated Stored Cross-Site Scripting
Slug
loco-translate
Published
2024-06-21
Title
Loco Translate < 2.6.10 - Cross-Site Request Forgery
Slug
loco-translate
Published
2026-03-30
Title
Loco Translate < 2.8.3 - Reflected XSS via 'update_href' Parameter
Slug
loco-translate
Published
2026-05-04
Title
Loco Translate < 2.8.3 - Translator+ Path Traversal to Limited File Read via 'ref' Parameter