WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
nmedia-user-file-uploader
Published
2025-11-24
Title
Frontend File Manager Plugin < 23.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File Renaming
Slug
nmedia-user-file-uploader
Published
2025-12-17
Title
Frontend File Manager < 23.5 - Subscriber+ Arbitrary File Deletion
Slug
nmedia-user-file-uploader
Published
2026-01-27
Title
Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending
Slug
nmedia-user-file-uploader
Published
2026-01-27
Title
Frontend File Manager Plugin < 23.6 - Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameter
Slug
nmedia-user-file-uploader
Published
2026-04-11
Title
Frontend File Manager Plugin <= 23.6 - Subscriber+ Arbitrary Download Access via IDOR
Slug
nmedia-user-file-uploader
Published
2026-01-16
Title
Frontend File Manager Plugin < 23.6 - Unauthenticated Insecure Direct Object Reference
Slug
nmedia-user-file-uploader
Published
2026-06-04
Title
Frontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post Deletion
Slug
nmedia-user-file-uploader
Published
2026-06-02
Title
Frontend File Manager Plugin <= 23.6 - Subscriber+ Stored Cross-Site Scripting via File Rename
Slug
nmedia-user-file-uploader
Published
2026-06-02
Title
Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download
Slug
nmedia-user-file-uploader
Published
2026-06-16
Title
Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal
Slug
nmedia-user-file-uploader
Published
2026-06-27
Title
Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion
Slug
nmr-strava-activities
Published
2024-10-31
Title
NMR Strava activities < 1.0.8 - Contributor+ Stored XSS
Slug
nmr-strava-activities
Published
2026-05-07
Title
NMR Strava activities < 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
no-api-amazon-affiliate
Published
2023-01-13
Title
No API Amazon Affiliate < 4.4.0 - Admin+ Stored XSS
Slug
no-bot-registration
Published
2024-04-09
Title
No-Bot Registration < 2.0 - Cross-Site Request Forgery
Slug
no-disposable-email
Published
2025-03-11
Title
No Disposable Email <= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
no-external-links
Published
2023-02-28
Title
WP No External Links <= 1.0.2 - Admin+ Stored XSS
Slug
no-future-posts
Published
2022-05-09
Title
No Future Posts <= 1.4 - Admin+ Stored Cross-Site Scripting
Slug
no-spam-at-all
Published
2025-06-05
Title
No Spam At All <= 1.3 - Missing Authorization
Slug
no-update-nag
Published
2024-08-08
Title
No Update Nag <= 1.4.12 - Unauthenticated Full Path Disclosure
Slug
noakes-menu-manager
Published
2025-04-09
Title
Nav Menu Manager < 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
nofollow
Published
2021-11-15
Title
Ultimate NoFollow <= 1.4.8 - Contributor+ Stored Cross-Site Scripting
Slug
nofollow-all-external-links
Published
2017-12-28
Title
No Follow All External Links 2.1.0-2.3.0 (current) - Backdoored
Slug
nofollow-free
Published
2025-01-16
Title
NoFollow Free <= 1.6.3 - Reflected Cross-Site Scripting
Slug
nofollow-jquery-links
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius