WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
polylang
Published
2014-08-01
Title
Polylang 1.5.1 - User Description H&ling Stored XSS
Slug
polylang
Published
2019-01-16
Title
Polylang <= 2.5 - CSRF in categories and media duplication
Slug
polylang
Published
2025-10-28
Title
Polylang < 3.7.4 - Contributor+ PHP Object Injection
Slug
polylang
Published
2026-07-22
Title
Polylang < 3.8.6 - Contributor+ Private Post Disclosure via Row Update AJAX Actions
Slug
polylang
Published
2026-09-30
Title
Polylang < 3.8.10 - Contributor+ Stored XSS
Slug
polylang
Published
2026-10-05
Title
Polylang < 3.8.8 - Contributor+ Sensitive Information Exposure
Slug
polylang
Published
2026-10-12
Title
Polylang < 3.8.10 - Editor+ PHP Object Injection
Slug
polylang-pro
Published
2026-10-12
Title
Polylang < 3.8.10 - Editor+ PHP Object Injection
Slug
polylang-pro
Published
2026-10-05
Title
Polylang < 3.8.8 - Contributor+ Sensitive Information Exposure
Slug
polylang-pro
Published
2026-09-30
Title
Polylang < 3.8.10 - Contributor+ Stored XSS
Slug
polylang-pro
Published
2026-07-22
Title
Polylang < 3.8.6 - Contributor+ Private Post Disclosure via Row Update AJAX Actions
Slug
polylang-pro
Published
2025-10-28
Title
Polylang < 3.7.4 - Contributor+ PHP Object Injection
Slug
polylang-supertext
Published
2025-05-07
Title
Supertext Translation and Proofreading <= 4.26 - Stored XSS via CSRF
Slug
pomo-editor
Published
2026-10-13
Title
PO/MO Editor <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter
Slug
pondol-bbs
Published
2025-10-19
Title
Pondol BBS <= 1.1.8.4 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
pondol-carousel
Published
2016-05-11
Title
pondol-carousel 1.0 - Cross-Site Scripting (XSS)
Slug
pondol-formmail
Published
2016-04-13
Title
Pondol Form to Mail <= 1.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Slug
pootle-button
Published
2017-10-12
Title
pootle button < 1.2.0 - Authenticated Cross-Site Scripting (XSS)
Slug
pootle-button
Published
2025-01-16
Title
Pootle button <= 1.2.0 - Reflected Cross-Site Scripting
Slug
pootle-page-builder
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
pootle-page-builder
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
pootle-page-builder
Published
2024-05-07
Title
Pootle Pagebuilder – WordPress Page builder <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
pop-over-xyz
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
pop-over-xyz
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
pop-up
Published
2022-09-26
Title
Pop-Up Chop Chop <= 2.1.7 - Contributor+ Stored Cross-Site Scripting