WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
my-calendar
Published
2026-03-03
Title
My Calendar – Accessible Event Manager < 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
my-calendar
Published
2026-05-13
Title
My Calendar < 3.7.10 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter
Slug
my-calendar
Published
2026-07-01
Title
My Calendar < 3.7.15 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter
Slug
my-calendar
Published
2026-07-07
Title
My Calendar < 3.7.9 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters
Slug
my-category-order
Published
2014-08-01
Title
My Category Order <= 2.8 - SQL Injection
Slug
my-category-order
Published
2015-08-13
Title
My Category Order <= 4.3 - Authenticated Cross-Site Scripting (XSS)
Slug
my-chatbot
Published
2021-09-06
Title
My Chatbot <= 1.1 - Reflected Cross-Site Scripting (XSS)
Slug
my-chatbot
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
my-contador-wp
Published
2024-11-20
Title
My Contador lesr < 2.1 - Missing Authorization to Unauthenticated User Registration CSV Export
Slug
my-content-management
Published
2023-06-30
Title
My Content Management < 1.7.7 - Admin+ Stored XSS
Slug
my-custom-css
Published
2024-08-08
Title
My Custom CSS PHP & ADS <= 3.3 - Unauthenticated Full Path Disclosure
Slug
my-default-post-content
Published
2025-03-24
Title
My Default Post Content <= 0.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
my-email-shortcode
Published
2026-05-26
Title
My Email Shortcode <= 0.91 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]
Slug
my-favorite-cars
Published
2025-01-16
Title
My Favorite Car <= 1.0 - Reflected Cross-Site Scripting
Slug
my-favorites
Published
2024-06-20
Title
My Favorites < 1.4.4 - Contributor+ Stored XSS
Slug
my-favorites
Published
2024-10-14
Title
My Favorites < 1.4.3 - Contributor+ Stored XSS
Slug
my-geo-posts-free
Published
2017-04-27
Title
My Geo Posts Free <= 1.2 - Unauthenticated PHP Object Injection
Slug
my-geo-posts-free
Published
2024-11-15
Title
My Geo Posts Free <= 1.2 - Unauthenticated PHP Object Injection
Slug
my-geo-posts-free
Published
2025-11-10
Title
My Geo Posts Free <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
my-idx-home-search
Published
2024-12-13
Title
My IDX Home Search < 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
my-idx-home-search
Published
2024-12-13
Title
My IDX Home Search < 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
my-instagram-feed
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
my-instagram-feed
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
my-instagram-feed
Published
2026-04-21
Title
Easy Social Photos Gallery <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper_class' Shortcode Attribute
Slug
my-link-order
Published
2015-11-23
Title
My Link Order <= 4.3 - Authenticated Cross-Site Scripting (XSS)