WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
morkva-ua-shipping
Published
2026-03-03
Title
Morkva UA Shipping < 1.7.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field
Slug
morpheus-slider
Published
2021-08-22
Title
Responsive 3D Slider <= 1.2 - Authenticated SQL Injection
Slug
mortgage-calculators-wp
Published
2022-01-11
Title
Mortgage Calculators WP < 1.56 - Admin+ Stored Cross-Site Scripting
Slug
mortgage-calculators-wp
Published
2024-04-16
Title
Mortgage Calculators WP < 1.60 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
mortgage-loan-calculator
Published
2021-11-16
Title
Mortgage Calculator / Loan Calculator < 1.5.17 - Contributor+ Stored Cross-Site Scripting
Slug
mortgage-loan-calculator
Published
2025-02-17
Title
Mortgage Calculator / Loan Calculator <= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
mosaic-gallery-advanced-gallery
Published
2026-07-02
Title
Mosaic Gallery – Advanced Gallery <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
mosaic-generator
Published
2025-08-11
Title
Mosaic Generator <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'c' Parameter
Slug
most-and-least-read-posts-widget
Published
2023-12-28
Title
Most And Least Read Posts Widget <=2.5.16 - Authenticated(Contributor+) SQL Injection via Widget settings
Slug
most-and-least-read-posts-widget
Published
2024-10-18
Title
Most And Least Read Posts Widget < 2.5.19 - Cross-Site Request Forgery via most_and_least_read_posts_options
Slug
most-and-least-read-posts-widget
Published
2025-04-16
Title
Most And Least Read Posts Widget < 2.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
most-popular-posts-widget-lite
Published
2023-10-02
Title
Most Popular Posts Widget < 0.9 - Admin+ SQL injection
Slug
motionger-elementor
Published
2025-12-10
Title
Motionger for Elementor <= 2.0.4 - Missing Authorization
Slug
motive-commerce-search
Published
2026-05-09
Title
AI Product Search for WooCommerce – Motive Commerce Search < 1.38.3 - Missing Authorization
Slug
motopress-appointment-lite
Published
2026-06-30
Title
MotoPress Appointment Booking < 2.4.6 - Authenticated (Staff+) SQL Injection via 's' Parameter
Slug
motopress-appointment-lite
Published
2026-07-02
Title
MotoPress Appointment Booking < 2.4.5 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter
Slug
motopress-hotel-booking
Published
2023-12-01
Title
Hotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & Deletion
Slug
motopress-hotel-booking-lite
Published
2023-03-16
Title
Hotel Booking Lite < 4.7.0 - Settings Update via CSRF
Slug
motopress-hotel-booking-lite
Published
2023-12-01
Title
Hotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & Deletion
Slug
motopress-hotel-booking-lite
Published
2024-05-10
Title
Hotel Booking Lite < 4.11.2 - Unauthenticated PHP Object Injection
Slug
motopress-hotel-booking-lite
Published
2025-11-25
Title
Hotel Booking Lite < 5.2.4 - Authenticated (Hotel Worker+) Remote Code Execution
Slug
motopress-hotel-booking-lite
Published
2026-05-21
Title
MotoPress Hotel Booking < 6.0.2 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action
Slug
motopress-hotel-booking-lite
Published
2026-07-01
Title
MotoPress Hotel Booking < 6.0.4 - Authenticated (Subscriber+) Information Exposure
Slug
motopress-hotel-booking-lite
Published
2026-07-09
Title
Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action
Slug
motopress-slider-lite
Published
2021-09-21
Title
Responsive WordPress Slider <= 2.2.0 - Subscriber+ Stored Cross-Site Scripting