WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
one-click-demo-import
Published
2024-05-07
Title
One Click Demo Import < 3.2.1 - Authenticated (Admin+) PHP Object Injection
Slug
one-click-login
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
one-click-order-reorder
Published
2024-07-03
Title
One Click Order Re-Order < 1.1.10 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
one-click-plugin-updater
Published
2022-05-23
Title
One Click Plugin Updater <= 2.4.14 - Arbitrary Settings Update via CSRF
Slug
one-click-ssl
Published
2019-07-11
Title
One Click SSL <= 1.4.6 - Multiple Issues
Slug
one-login
Published
2025-06-09
Title
One-Login <= 1.4 - Unauthenticated Privilege Esclation
Slug
one-page-blocks
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
one-page-blocks
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
one-page-blocks
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
one-page-express-companion
Published
2024-06-06
Title
One Page Express Companion < 1.6.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via one_page_express_contact_form Shortcode
Slug
one-page-express-companion
Published
2025-10-16
Title
One Page Express Companion < 1.6.44 - Missing Authorization
Slug
one-user-avatar
Published
2021-09-20
Title
One User Avatar < 2.3.7 - Contributor+ Stored Cross-Site Scripting
Slug
one-user-avatar
Published
2021-09-20
Title
One User Avatar < 2.3.7 - Avatar Update via CSRF
Slug
oneclick-whatsapp-order
Published
2022-12-28
Title
OneClick Chat to Order < 1.0.4.2 - Contributor+ Stored XSS via Shortcode
Slug
oneclick-whatsapp-order
Published
2023-11-07
Title
OneClick Chat to Order < 1.0.5 - Admin+ Stored XSS
Slug
oneclick-whatsapp-order
Published
2024-01-08
Title
OneClick Chat to Order < 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
oneclick-whatsapp-order
Published
2024-04-25
Title
OneClick Chat to Order < 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
oneclick-whatsapp-order
Published
2025-11-21
Title
OneClick Chat to Order < 1.0.9 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure
Slug
oneelements-ultimate-addons-for-elementor
Published
2024-09-24
Title
OneElements – Best Elementor Addons <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
onelogin-saml-sso
Published
2016-06-06
Title
OneLogin SAML SSO <= 2.1.5 - Authentication Bypass
Slug
onelogin-saml-sso
Published
2016-06-06
Title
OneLogin SAML SSO < 2.2.0 - Provisioned User Hardcoded Password
Slug
onelogin-saml-sso
Published
2016-10-14
Title
OneLogin SAML SSO <= 2.4.2 - Signature Wrapping
Slug
onesignal-free-web-push-notifications
Published
2019-07-18
Title
OneSignal Web Push Notifications - Stored XSS
Slug
onesignal-free-web-push-notifications
Published
2025-12-15
Title
OneSignal – Web Push Notifications < 3.6.2 - Missing Authorization to Unauthenticated Plugin Settings Update
Slug
onestore-sites
Published
2025-02-03
Title
OneStore Sites <= 0.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Installation