WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
mwb-bookings-for-woocommerce
Published
2026-06-26
Title
WPS Bookings for WooCommerce < 3.11.7 - Subscriber+ Arbitrary Booking Order Cancellation via IDOR
Slug
mwb-point-of-sale-pos-for-woocommerce
Published
2021-08-10
Title
MWB Point of Sale (POS) for WooCommerce < 1.0.1 - CSRF Bypass / Unauthorised AJAX Call
Slug
mwp-countdown
Published
2022-03-07
Title
Wow Countdowns <= 3.1.2 - Admin+ SQLi
Slug
mwp-forms
Published
2021-10-07
Title
Wow Forms <= 3.1.3 - Admin+ SQL Injection
Slug
mwp-herd-effect
Published
2022-05-16
Title
Herd Effects < 5.2.1 - Admin+ LFI
Slug
mwp-herd-effect
Published
2023-05-22
Title
Multiple Plugins from Wow-Company - Reflected XSS
Slug
mwp-herd-effect
Published
2023-08-21
Title
Herd Effects < 5.2.3 - Admin+ Stored XSS
Slug
mwp-herd-effect
Published
2023-08-21
Title
Herd Effects < 5.2.4 - Effect Deletion via CSRF
Slug
mwp-herd-effect
Published
2024-04-11
Title
Herd Effects < 5.2.7 - Effect Deletion via CSRF
Slug
mwp-herd-effect
Published
2025-01-24
Title
Herd Effects < 6.2.2 - Cross-Site Request Forgery to Settings Update
Slug
mwp-skype
Published
2023-05-22
Title
Multiple Plugins from Wow-Company - Reflected XSS
Slug
mwp-skype
Published
2024-04-11
Title
Wow Skype Buttons < 4.0.4 - Button Deletion via CSRF
Slug
mww-disclaimer-buttons
Published
2024-04-12
Title
MWW Disclaimer Buttons < 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
mww-disclaimer-buttons
Published
2025-09-26
Title
MWW Disclaimer Buttons < 3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
mx-time-zone-clocks
Published
2021-08-25
Title
MX Time Zone Clocks < 3.4.1 - Contributor+ Cross-Site Scripting
Slug
mx-time-zone-clocks
Published
2025-04-01
Title
MX Time Zone Clocks <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
mx-time-zone-clocks
Published
2025-12-31
Title
MX Time Zone Clocks <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
mxchat-basic
Published
2025-10-22
Title
MxChat – AI Chatbot for WordPress < 2.4.7 - Unauthenticated Blind Server-Side Request Forgery
Slug
mxchat-basic
Published
2025-12-02
Title
MxChat – AI Chatbot for WordPress < 2.5.6 - Unauthenticated Information Exposure
Slug
mxchat-basic
Published
2026-07-15
Title
MxChat < 3.2.11 - Authenticated (Admin+) Stored Cross-Site Scripting via 'intro_message' Setting
Slug
my-account-page-editor
Published
2023-09-07
Title
My Account Page Editor < 1.3.2 - Subscriber+ Arbitrary File Upload
Slug
my-album-gallery
Published
2026-01-06
Title
My Album Gallery <= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title
Slug
my-album-gallery
Published
2026-01-06
Title
My Album Gallery <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style_css' Shortcode Attribute
Slug
my-album-gallery
Published
2026-03-05
Title
My Album Gallery <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Deletion
Slug
my-askai
Published
2025-09-29
Title
My AskAI <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting