WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
post-connector
Published
2015-04-20
Title
Post Connector < 1.0.4 - XSS
Slug
post-connector
Published
2023-07-20
Title
Post Connector < 1.0.10 - Admin+ Stored Cross-Site Scripting
Slug
post-connector
Published
2025-08-06
Title
Post Connector <= 1.0.11 - Reflected Cross-Site Scripting
Slug
post-content-xmlrpc
Published
2021-10-07
Title
Post Content XMLRPC <= 1.0 - Admin+ SQL Injections
Slug
post-custom-templates-lite
Published
2025-04-01
Title
Post Custom Templates Lite <= 1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
post-custom-templates-lite
Published
2025-06-05
Title
Post Custom Templates Lite <= 1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
post-duplicator
Published
2016-04-06
Title
Post Duplicator <= 2.16 - Cross-Site Scripting (XSS)
Slug
post-duplicator
Published
2021-12-02
Title
Post Duplicator < 2.27 - Admin+ Stored Cross-Site Scripting
Slug
post-duplicator
Published
2023-12-05
Title
Post Duplicator < 2.32 - Missing Authorization via mtphr_duplicate_post
Slug
post-duplicator
Published
2025-01-10
Title
Post Duplicator < 2.37 - Authenticated (Contributor+) Protected Post Disclosure
Slug
post-duplicator
Published
2025-01-24
Title
Post Duplicator < 2.36 - Missing Authorization
Slug
post-duplicator
Published
2026-02-24
Title
Post Duplicator < 3.0.9 - Missing Authorization to Authenticated (Contributor+) Protected Post Meta Insertion via 'customMetaData' Parameter
Slug
post-duplicator
Published
2026-04-13
Title
Post Duplicator < 3.0.11 - Contributor+ PHP Object Injection
Slug
post-duplicator
Published
2026-06-03
Title
Post Duplicator < 3.0.15 - Contributor+ PHP Object Injection via customMetaData
Slug
post-duplicator
Published
2026-08-21
Title
Post Duplicator < 3.0.12 - Authorization Bypass to Authenticated (Contributor+) Post Duplication
Slug
post-duplicator
Published
2026-08-21
Title
Post Duplicator < 3.0.12 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution
Slug
post-expirator
Published
2014-08-01
Title
Post Expirator <= 2.1.1 - Cross-Site Request Forgery
Slug
post-expirator
Published
2021-10-11
Title
Post Expirator < 2.6.0 - Contributor+ Arbitrary Post Schedule Deletion
Slug
post-expirator
Published
2025-11-20
Title
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories < 4.9.2 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification
Slug
post-expirator
Published
2025-12-15
Title
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories < 4.9.3 - Missing Authorization to Authenticated (Contributor+) Authors' Emails Exposure
Slug
post-expirator
Published
2026-01-08
Title
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories < 4.9.4 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation
Slug
post-expirator
Published
2026-01-11
Title
Post Expirator < 4.9.4 - Missing Authorization
Slug
post-expirator
Published
2026-03-22
Title
Post Expirator < 4.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
post-expirator
Published
2026-05-04
Title
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories < 4.10.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute
Slug
post-export-import-with-media
Published
2026-07-09
Title
Post Export Import with Media < 1.13.2 - Authenticated (Administrator+) Arbitrary File Upload via Trailing-Dot Filename Bypass in ZIP Media Import