WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
mylinksdump
Published
2014-08-01
Title
myLDlinker - SQL Injection
Slug
mylinksdump
Published
2026-03-20
Title
myLinksDump <= 1.6 - Authenticated (Administrator+) SQL Injection via 'sort_by' and 'sort_order' Parameters
Slug
mynx-page-builder
Published
2024-10-11
Title
Mynx Page Builder <= 0.27.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
myorderdesk
Published
2024-10-31
Title
MyOrderDesk < 3.3.0 - Contributor+ Stored XSS
Slug
mypixs
Published
2015-09-15
Title
MyPixs <= 0.3 - Unauthenticated Local File Inclusion (LFI)
Slug
myqtip-easy-qtip2
Published
2026-03-06
Title
MyQtip – easy qTip2 <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
myshopkit-popup-smartbar-slidein
Published
2024-02-26
Title
WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit <= 1.0.9 - Unauthenticated Sensitive Information Exposure
Slug
myshouts-shoutbox
Published
2025-09-19
Title
Author: Munzir <= 0.9 - Reflected Cross-Site Scripting
Slug
mystat
Published
2014-08-01
Title
mySTAT <= 2.6 - SQL Injection
Slug
mystickyelements
Published
2022-01-10
Title
All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
mystickyelements
Published
2023-02-06
Title
My Sticky Elements < 2.0.9 - Admin+ SQLi
Slug
mystickyelements
Published
2023-07-03
Title
All-in-one Floating Contact Form < 2.1.2 - Admin+ Stored Cross-Site Scripting
Slug
mystickyelements
Published
2023-12-26
Title
All-in-one Floating Contact Form < 2.1.4 - Unauthenticated Unauthorised Action
Slug
mystickyelements
Published
2025-12-31
Title
My Sticky Elements < 2.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Bulk Lead Deletion
Slug
mystickyelements
Published
2025-12-25
Title
My Sticky Elements < 2.3.4 - Missing Authorization
Slug
mystickymenu
Published
2021-06-21
Title
myStickymenu < 2.5.2 - Authenticated Stored XSS
Slug
mystickymenu
Published
2023-10-27
Title
myStickymenu < 2.6.5 - Subscriber+ Arbitrary Form Leads Deletion
Slug
mystickymenu
Published
2024-01-03
Title
My Sticky Bar < 2.6.7 - CSV Export via CSRF to Sensitive Information Disclosure
Slug
mystickymenu
Published
2024-02-28
Title
My Sticky Bar < 2.6.8 - Admin+ Stored XSS
Slug
mystickymenu
Published
2024-07-11
Title
My Sticky Bar < 2.7.2 - Admin+ Stored XSS
Slug
mystickymenu
Published
2024-08-23
Title
My Sticky Bar < 2.7.3 - Admin+ Stored XSS
Slug
mystickymenu
Published
2026-03-11
Title
My Sticky Bar < 2.8.7 - Unauthenticated SQLi via 'stickymenu_contact_lead_form' Action
Slug
mystyle-custom-product-designer
Published
2025-06-03
Title
MyStyle Custom Product Designer < 3.21.2 - Unauthenticated SQL Injection
Slug
myticket-events
Published
2025-02-21
Title
MyTicket Events <= 1.2.4 - Unauthenticated Limited File Read
Slug
mytreasures
Published
2015-05-14
Title
Multiple Plugins - jQuery prettyPhoto DOM Cross-Site Scripting (XSS)