WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
newsmanapp
Published
2024-12-12
Title
NewsmanApp < 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
newsmanapp
Published
2025-09-26
Title
NewsmanApp < 3.0.0 - Cross-Site Request Forgery
Slug
newspack-ads
Published
2024-07-01
Title
Newspack Ads < 1.47.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
newspack-blocks
Published
2024-06-20
Title
Newspack Blocks < 3.0.9 - Unauthenticated Sensitive Information Exposure
Slug
newspack-blocks
Published
2024-06-28
Title
Newspack Blocks < 3.0.9 - Authenticated (Contributor+) Arbitrary File Upload
Slug
newspack-blocks
Published
2024-06-28
Title
Newspack Blocks < 3.0.9 - Authenticated (Contributor+) Arbitrary Directory Deletion
Slug
newspack-blocks
Published
2024-06-28
Title
Newspack Blocks < 3.0.9 - Missing Authorization
Slug
newspack-content-converter
Published
2024-07-01
Title
Newspack Content Converter < 1.0.0 - Missing Authorization
Slug
newspack-newsletters
Published
2024-06-21
Title
Newspack Newsletters < 2.13.3 - Cross-Site Request Forgery
Slug
newspack-newsletters
Published
2024-07-01
Title
Newspack Newsletters < 2.13.3 - Missing Authorization
Slug
newspack-newsletters
Published
2025-06-05
Title
Newspack Newsletters < 3.14.0 - Open Redirect
Slug
newspack-popups
Published
2024-07-01
Title
Newspack Campaigns < 2.31.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
newsplugin
Published
2021-07-21
Title
NewsPlugin < 1.1.0 - CSRF to Stored Cross-Site Scripting
Slug
newsplus-shortcodes
Published
2026-07-02
Title
NewsPlus Shortcodes <= 4.2.0 - Authenticated (Contributor+) Local File Inclusion
Slug
newstatpress
Published
2015-05-25
Title
NewStatPress 0.9.8 - XSS & SQL Injection
Slug
newstatpress
Published
2015-06-30
Title
NewStatPress <= 1.0.3 - Unauthenticated Stored Cross-Site Scripting (XSS)
Slug
newstatpress
Published
2015-07-07
Title
NewStatPress < 1.0.6 - SQL Injection
Slug
newstatpress
Published
2015-07-07
Title
NewStatPress < 1.0.6 - Reflected Cross-Site Scripting (XSS)
Slug
newstatpress
Published
2017-03-01
Title
NewStatPress <= 1.2.4 - Stored Cross-Site Scripting (XSS)
Slug
newstatpress
Published
2015-06-08
Title
Newstatpress < 1.0.1 - SQL Injection
Slug
newstatpress
Published
2022-01-13
Title
NewStatPress < 1.3.6 - Reflected Cross-Site Scripting
Slug
newstatpress
Published
2025-12-11
Title
NewStatPress < 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
newstatpress
Published
2026-07-13
Title
NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget
Slug
newsticker
Published
2024-11-08
Title
News Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
nex-forms
Published
2021-07-20
Title
NEX Forms < 7.8.8 - Authentication Bypass for Excel Reports