WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
mage-eventpress
Published
2025-12-06
Title
WpEvently < 5.1.2 - Cross-Site Request Forgery
Slug
mage-eventpress
Published
2025-12-25
Title
WpEvently < 5.0.9 - Authenticated (Contributor+) PHP Object Injection
Slug
mage-eventpress
Published
2026-02-18
Title
WpEvently < 5.1.2 - Unauthenticated PHP Object Injection
Slug
mage-eventpress
Published
2026-03-20
Title
Event Booking Manager for WooCommerce < 5.1.5 - Reflected Cross-Site Scripting
Slug
mage-eventpress
Published
2026-02-14
Title
WpEvently < 5.1.9 - Unauthenticated Information Exposure
Slug
mage-eventpress
Published
2026-05-26
Title
Event Booking Manager for WooCommerce < 5.3.4 - Missing Authorization
Slug
mage-eventpress
Published
2026-07-22
Title
Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content
Slug
mage-eventpress
Published
2026-07-22
Title
Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content
Slug
mage-eventpress
Published
2026-07-22
Title
Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event
Slug
mage-eventpress
Published
2026-07-28
Title
Event Booking Manager for WooCommerce < 5.3.8 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action
Slug
mage-eventpress
Published
2026-08-27
Title
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar < 5.6.0 - Missing Authorization
Slug
mage-eventpress
Published
2026-08-27
Title
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar < 5.6.0 - Missing Authorization
Slug
mage-eventpress-pro
Published
2026-07-27
Title
Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price
Slug
mage-forms
Published
2024-11-08
Title
Mage Front End Forms <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
magee-shortcodes
Published
2022-01-17
Title
Magee Shortcodes < 2.0.9 - Reflected Cross-Site Scripting
Slug
magee-shortcodes
Published
2023-09-21
Title
Magee Shortcodes <= 2.1.1 - Contributor+ Stored XSS via shortcode
Slug
magic-action-box
Published
2023-09-27
Title
Magic Action Box <= 2.17.2 - Contributor+ Stored XSS
Slug
magic-buttons-for-elementor
Published
2025-07-01
Title
Magic Buttons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode
Slug
magic-buttons-for-elementor
Published
2025-07-01
Title
Magic Buttons for Elementor < 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode
Slug
magic-carousel
Published
2025-05-16
Title
Magic Responsive Slider and Carousel WordPress < 1.6 - Authenticated (Contributor+) SQL Injection
Slug
magic-conversation-for-gravity-forms
Published
2026-04-07
Title
Magic Conversation For Gravity Forms < 3.0.98 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
magic-edge-lite-image-background-remover
Published
2025-08-01
Title
Magic Edge – Lite <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via height Parameter
Slug
magic-export-import
Published
2026-04-13
Title
Magic Export & Import < 1.2.0 - Unauthenticated PII Disclosure
Slug
magic-fields
Published
2017-03-01
Title
Magic Fields <= 1.7.1 - Authenticated Cross-Site Scripting (XSS)
Slug
magic-google-maps
Published
2025-01-16
Title
Magic Google Maps <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting