WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
mycred
Published
2025-07-30
Title
myCred < 2.9.4.4 - Authenticated (Subscriber+) Race Condition
Slug
mycred
Published
2025-12-12
Title
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program < 2.9.7.1 - Missing Authorization to Unauthenticated Withdrawal Request Approval
Slug
mycred
Published
2025-12-18
Title
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program < 2.9.7.2 - Missing Authorization to Sensitive Information Exposure
Slug
mycred
Published
2026-02-06
Title
myCred < 2.9.7.4 - Missing Authorization
Slug
mycred
Published
2026-02-13
Title
myCred < 2.9.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode
Slug
mycred
Published
2025-11-08
Title
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program. <= 2.9.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
mycred-for-elementor
Published
2024-10-21
Title
myCred Elementor < 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
mycryptocheckout
Published
2023-04-06
Title
MyCryptoCheckout < 2.124 - Reflected XSS
Slug
mycryptocheckout
Published
2023-09-04
Title
MyCryptoCheckout < 2.126 - CSRF
Slug
mycss
Published
2022-06-06
Title
MyCSS <= 1.1 - Arbitrary Settings Update via CSRF
Slug
mycurator
Published
2023-07-11
Title
MyCurator Content Curation < 3.75 - Cross-Site Request Forgery
Slug
mycurator
Published
2024-03-18
Title
MyCurator Content Curation < 3.77 - Reflected Cross-Site Scripting
Slug
mycurator
Published
2024-11-01
Title
MyCurator Content Curation < 3.79 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
mycustomwidget
Published
2025-04-25
Title
My Custom Widgets <= 2.0.5 - Reflected Cross-Site Scripting
Slug
myd-delivery
Published
2025-12-31
Title
MyD Delivery <= 1.3.7 - Unauthenticated Insecure Direct Object Reference
Slug
myeasybackup
Published
2012-01-16
Title
myEASYbackup <= 1.0.8.1 - Directory Traversal
Slug
myflash
Published
2014-08-01
Title
Myflash <= 1.00 - (wppath) RFI
Slug
myflash
Published
2014-08-01
Title
Myflash - myextractXML.php path Parameter Arbitrary File Access
Slug
myftp-ftp-like-plugin-for-wordpress
Published
2014-08-01
Title
myftp-ftp-like-plugin-for-wordpress v2 - SQL Injection
Slug
mygallery
Published
2007-04-29
Title
myGallery <= 1.4b4 - Unauthenticated File Inclusion
Slug
myhome-core
Published
2026-01-21
Title
MyHome Core < 4.1.1 - Unauthenticated Local File Inclusion
Slug
mylco
Published
2025-12-05
Title
myLCO <= 0.8.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Slug
mylinksdump
Published
2014-08-01
Title
myLDlinker - SQL Injection
Slug
mynx-page-builder
Published
2024-10-11
Title
Mynx Page Builder <= 0.27.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
myorderdesk
Published
2024-10-31
Title
MyOrderDesk < 3.3.0 - Contributor+ Stored XSS