WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
mycss
Published
2022-06-06
Title
MyCSS <= 1.1 - Arbitrary Settings Update via CSRF
Slug
mycurator
Published
2023-07-11
Title
MyCurator Content Curation < 3.75 - Cross-Site Request Forgery
Slug
mycurator
Published
2024-03-18
Title
MyCurator Content Curation < 3.77 - Reflected Cross-Site Scripting
Slug
mycurator
Published
2024-11-01
Title
MyCurator Content Curation < 3.79 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
mycustomwidget
Published
2025-04-25
Title
My Custom Widgets <= 2.0.5 - Reflected Cross-Site Scripting
Slug
myd-delivery
Published
2025-12-31
Title
MyD Delivery <= 1.3.7 - Unauthenticated Insecure Direct Object Reference
Slug
myeasybackup
Published
2012-01-16
Title
myEASYbackup <= 1.0.8.1 - Directory Traversal
Slug
myflash
Published
2014-08-01
Title
Myflash <= 1.00 - (wppath) RFI
Slug
myflash
Published
2014-08-01
Title
Myflash - myextractXML.php path Parameter Arbitrary File Access
Slug
myftp-ftp-like-plugin-for-wordpress
Published
2014-08-01
Title
myftp-ftp-like-plugin-for-wordpress v2 - SQL Injection
Slug
mygallery
Published
2007-04-29
Title
myGallery <= 1.4b4 - Unauthenticated File Inclusion
Slug
mylco
Published
2025-12-05
Title
myLCO <= 0.8.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Slug
mylinksdump
Published
2014-08-01
Title
myLDlinker - SQL Injection
Slug
mynx-page-builder
Published
2024-10-11
Title
Mynx Page Builder <= 0.27.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
myorderdesk
Published
2024-10-31
Title
MyOrderDesk < 3.3.0 - Contributor+ Stored XSS
Slug
mypixs
Published
2015-09-15
Title
MyPixs <= 0.3 - Unauthenticated Local File Inclusion (LFI)
Slug
myshopkit-popup-smartbar-slidein
Published
2024-02-26
Title
WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit <= 1.0.9 - Unauthenticated Sensitive Information Exposure
Slug
myshouts-shoutbox
Published
2025-09-19
Title
Author: Munzir <= 0.9 - Reflected Cross-Site Scripting
Slug
mystat
Published
2014-08-01
Title
mySTAT <= 2.6 - SQL Injection
Slug
mystickyelements
Published
2022-01-10
Title
All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
mystickyelements
Published
2023-02-06
Title
My Sticky Elements < 2.0.9 - Admin+ SQLi
Slug
mystickyelements
Published
2023-07-03
Title
All-in-one Floating Contact Form < 2.1.2 - Admin+ Stored Cross-Site Scripting
Slug
mystickyelements
Published
2023-12-26
Title
All-in-one Floating Contact Form < 2.1.4 - Unauthenticated Unauthorised Action
Slug
mystickyelements
Published
2025-12-31
Title
My Sticky Elements < 2.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Bulk Lead Deletion
Slug
mystickyelements
Published
2025-12-25
Title
My Sticky Elements < 2.3.4 - Missing Authorization