WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
php-everywhere
Published
2022-02-08
Title
PHP Everywhere < 3.0.0 - Contributor+ RCE via Gutenberg Block
Slug
php-execution-plugin
Published
2023-02-02
Title
PHP Execution <= 1.0.0 - Settings Update via CSRF
Slug
php-shell
Published
2014-08-01
Title
PHP Shell Plugin
Slug
php-to-page
Published
2023-10-29
Title
PHP to Page <= 0.3 - Authenticated (Subscriber+) Local File Inclusion to Remote Code Execution via Shortcode
Slug
php_speedy_wp
Published
2014-08-01
Title
PHP Speedy <= 0.5.2 - (admin_container.php) Remote Code Exec Exploit
Slug
phpfreechat
Published
2014-08-01
Title
PHPFreeChat 0.2.8 - lib/csstidy-1.2/css_optimiser.php url Parameter XSS
Slug
phpinfo-wp
Published
2024-06-19
Title
phpinfo() WP < 6.0 - Unauthenticated Information Exposure
Slug
phplist-form-integration
Published
2025-02-13
Title
WP PHPList <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
phpls
Published
2025-09-10
Title
PhpList Subber <= 1.1 - Cross-Site Request Forgery
Slug
phppoet-checkout-fields
Published
2024-02-14
Title
WooCommerce Easy Checkout Field Editor, Fees & Discounts < 3.5.13 - Unauthenticated Arbitrary File Upload
Slug
phpsword-favicon-manager
Published
2024-05-06
Title
Pk Favicon Manager <=2.1 - Authenticated (Admin+) Arbitrary File Upload
Slug
phraseanet-client
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
phzoom
Published
2024-12-12
Title
phZoom <= 1.2.92 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
pi-woocommerce-order-date-time-and-type
Published
2023-06-26
Title
Order date time for WooCommerce < 3.0.20 - Admin+ Stored XSS
Slug
pica-photo-gallery
Published
2014-08-01
Title
SWFUpload - Cross-Site Scripting (XSS)
Slug
pica-photo-gallery
Published
2014-08-01
Title
Pica Photo Gallery - Arbitrary File Upload
Slug
pica-photo-gallery
Published
2014-08-01
Title
PICA Photo Gallery - Remote File Disclosure
Slug
pickup-and-delivery-from-customer-locations-for-woocommerce
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
pickup-and-delivery-from-customer-locations-for-woocommerce
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
pico
Published
2025-12-04
Title
Hype <= 1.0.5 - Missing Authorization
Slug
picsmize
Published
2024-11-11
Title
Picsmize <= 1.0.0 - Unauthenticated Arbitrary File Upload
Slug
pictobrowser-gallery
Published
2014-12-18
Title
Pictobrowser Gallery <= 0.3.1 - Multiple CSRF
Slug
pictpress
Published
2014-08-01
Title
PictPress <= 0.91 - Remote File Disclosure
Slug
picture-gallery
Published
2021-08-10
Title
Picture Gallery < 1.4.4 - Authenticated Stored XSS
Slug
picture-gallery
Published
2024-05-14
Title
Picture Gallery < 1.5.12 - Authenticated (Author+) Stored Cross-Site Scripting