WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
localize-remote-images
Published
2023-08-29
Title
Localize Remote Images <= 1.0.9 - Settings Update via CSRF
Slug
localseomap-for-elementor
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
locateandfilter
Published
2024-09-30
Title
LocateAndFilter < 1.6.16 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
locateandfilter
Published
2025-05-07
Title
LocateAndFilter < 1.6.17 - Missing Authorization
Slug
location-click-map
Published
2024-11-08
Title
Location Click Map <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
location-piker
Published
2025-01-16
Title
Google Map With Fancybox <= 2.1.0 - Reflected Cross-Site Scripting
Slug
location-weather
Published
2023-01-18
Title
Location Weather < 1.3.4 - Contributor+ Stored XSS
Slug
location-weather
Published
2026-05-21
Title
Location Weather < 3.0.3 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging
Slug
location-weather
Published
2026-07-27
Title
Location Weather < 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
locations
Published
2021-07-05
Title
CSRF Bypass in Multiple Plugins
Slug
locations
Published
2021-07-05
Title
Locations < 4.0 - Cross-Site Request Forgery
Slug
locations
Published
2023-10-02
Title
Locations <= 4.0 - Contributor+ Stored XSS
Slug
locations-and-areas
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
locations-and-areas
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
locatoraid
Published
2023-02-14
Title
Locatoraid Store Locator < 3.9.12 - CSRF
Slug
locatoraid
Published
2023-04-17
Title
Locatoraid Store Locator < 3.9.15 - Contributor+ Stored Cross-Site Scripting
Slug
locatoraid
Published
2023-05-11
Title
Locatoraid Store Locator < 3.9.19 - Subscriber+ Stored XSS
Slug
locatoraid
Published
2023-08-28
Title
Locatoraid Store Locator < 3.9.24 - Reflected XSS
Slug
locatoraid
Published
2024-03-25
Title
Locatoraid Store Locator < 3.9.31 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
locatoraid
Published
2024-10-15
Title
Locatoraid Store Locator < 3.9.48 - Reflected Cross-Site Scripting
Slug
locatoraid
Published
2025-01-03
Title
Locatoraid Store Locator < 3.9.51 - Unauthenticated PHP Object Injection
Slug
locatoraid
Published
2025-12-31
Title
Locatoraid Store Locator <= 3.9.65 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
locatoraid
Published
2026-08-20
Title
Locatoraid Store Locator < 3.9.73 - Unauthenticated SQL Injection
Slug
lock-my-bp
Published
2022-04-11
Title
Wbcom Designs Plugins - Subscriber+ Arbitrary Plugin Installation, Activation and Deactivation
Slug
lock-my-bp
Published
2025-12-15
Title
Wbcom Designs < 2.1.2 - Missing Authorization