WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
photoshelter-official-plugin
Published
2025-04-01
Title
PhotoShelter for Photographers Blog Feed Plugin <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
photoshow
Published
2024-06-22
Title
Smart Image Gallery < 1.0.19 - Update/Delete Google API Key via CSRF
Slug
photospace
Published
2022-09-12
Title
Photospace Gallery <= 2.3.5 - Subscriber+ Arbitrary Settings Update
Slug
photospace
Published
2022-11-14
Title
Photospace Gallery <= 2.3.5 - Subscriber+ Stored Cross-Site Scripting
Slug
photospace-responsive
Published
2019-06-22
Title
Photospace Responsive < 1.1.8 - Authenticated XSS
Slug
photospace-responsive
Published
2023-09-12
Title
Photospace Responsive < 2.1.2 - Admin+ Stored XSS
Slug
photospace-responsive
Published
2025-09-27
Title
Photospace Responsive <= 2.2.0 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
photostack-gallery
Published
2026-02-13
Title
PhotoStack Gallery <= 0.4.1 - Unauthenticated SQL Injection via 'postid' Parameter
Slug
photoswipe-masonry
Published
2022-02-24
Title
Photoswipe Masonry Gallery < 1.2.15 - Subscriber+ Stored Cross-Site Scripting
Slug
photoxhibit
Published
2016-10-10
Title
Photoxhibit <= 2.1.8 - Reflected XSS Issues
Slug
phox-host
Published
2026-03-18
Title
Phox Hosting < 2.0.9 - Reflected Cross-Site Scripting
Slug
php-analytics
Published
2014-08-01
Title
php-analytics - ofc_upload_image.php Arbitrary File Upload
Slug
php-compatibility-checker
Published
2023-04-06
Title
PHP Compatibility Checker < 1.6.0 - Cross-Site Request Forgery
Slug
php-event-calendar
Published
2015-04-02
Title
PHP Event Calendar <= 1.5 - Arbitrary File Upload
Slug
php-everywhere
Published
2022-01-13
Title
PHP Everywhere < 2.0.3 - Arbitrary Settings Update via CSRF
Slug
php-everywhere
Published
2022-02-08
Title
PHP Everywhere < 3.0.0 - Subscriber+ RCE via Shortcode
Slug
php-everywhere
Published
2022-02-08
Title
PHP Everywhere < 3.0.0 - Contributor+ RCE via Metabox
Slug
php-everywhere
Published
2022-02-08
Title
PHP Everywhere < 3.0.0 - Contributor+ RCE via Gutenberg Block
Slug
php-execution-plugin
Published
2023-02-02
Title
PHP Execution <= 1.0.0 - Settings Update via CSRF
Slug
php-shell
Published
2014-08-01
Title
PHP Shell Plugin
Slug
php-to-page
Published
2023-10-29
Title
PHP to Page <= 0.3 - Authenticated (Subscriber+) Local File Inclusion to Remote Code Execution via Shortcode
Slug
php_speedy_wp
Published
2014-08-01
Title
PHP Speedy <= 0.5.2 - (admin_container.php) Remote Code Exec Exploit
Slug
phpfreechat
Published
2014-08-01
Title
PHPFreeChat 0.2.8 - lib/csstidy-1.2/css_optimiser.php url Parameter XSS
Slug
phpinfo-wp
Published
2024-06-19
Title
phpinfo() WP < 6.0 - Unauthenticated Information Exposure
Slug
phplist-form-integration
Published
2025-02-13
Title
WP PHPList <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting