WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
polls-widget
Published
2022-08-25
Title
Poll, Survey, Questionnaire and Voting system <= 1.7.4 - Admin+ Stored XSS
Slug
polo-video-gallery
Published
2021-09-20
Title
Polo Video Gallery <= 1.2 - Contributor+ Stored Cross-Site Scripting
Slug
polylang
Published
2014-08-01
Title
Polylang 1.5.1 - User Description H&ling Stored XSS
Slug
polylang
Published
2019-01-16
Title
Polylang <= 2.5 - CSRF in categories and media duplication
Slug
polylang
Published
2025-10-28
Title
Polylang < 3.7.4 - Contributor+ PHP Object Injection
Slug
polylang-supertext
Published
2025-05-07
Title
Supertext Translation and Proofreading <= 4.26 - Stored XSS via CSRF
Slug
pondol-bbs
Published
2025-10-19
Title
Pondol BBS <= 1.1.8.4 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
pondol-carousel
Published
2016-05-11
Title
pondol-carousel 1.0 - Cross-Site Scripting (XSS)
Slug
pondol-formmail
Published
2016-04-13
Title
Pondol Form to Mail <= 1.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Slug
pootle-button
Published
2017-10-12
Title
pootle button < 1.2.0 - Authenticated Cross-Site Scripting (XSS)
Slug
pootle-button
Published
2025-01-16
Title
Pootle button <= 1.2.0 - Reflected Cross-Site Scripting
Slug
pootle-page-builder
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
pootle-page-builder
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
pootle-page-builder
Published
2024-05-07
Title
Pootle Pagebuilder – WordPress Page builder <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
pop-over-xyz
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
pop-over-xyz
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
pop-up
Published
2022-09-26
Title
Pop-Up Chop Chop <= 2.1.7 - Contributor+ Stored Cross-Site Scripting
Slug
pop-up
Published
2025-03-28
Title
Pop-Up Chop Chop <= 2.1.7 - Authenticated (Contributor+) Local File Inclusion
Slug
pop-up-pop-up
Published
2022-09-02
Title
Pop-up < 1.1.6 - Arbitrary Settings Update via CSRF
Slug
pop-up-pop-up
Published
2023-07-27
Title
Multiple Plugins from Inisev - Subscriber+ Plugin Installation
Slug
pop-up-pop-up
Published
2023-07-27
Title
Multiple Plugins from Inisev - Plugin Installation via CSRF
Slug
popad
Published
2025-09-03
Title
PopAd <= 1.0.4 - Cross-Site Request Forgery to Settings Update
Slug
popad
Published
2025-09-26
Title
PopAd <= 1.0.4 - Authenticated (Admin+) Server-Side Request Forgery
Slug
popcashnet-code-integration-tool
Published
2017-10-12
Title
PopCash.Net Code Integration Tool <= 1.0 - Cross-Site Scripting (XSS)
Slug
popcashnet-code-integration-tool
Published
2026-01-11
Title
PopCash.Net Code Integration Tool < 2.0 - Missing Authorization