WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
powerpress
Published
2025-10-21
Title
PowerPress Podcasting < 11.14 - Cross-Site Request Forgery
Slug
powerpress
Published
2025-11-26
Title
Blubrry PowerPress < 11.15.3 - Authenticated (Contributor+) Arbitrary File Upload via 'powerpress_edit_post'
Slug
powerpress
Published
2026-02-25
Title
PowerPress Podcasting plugin by Blubrry < 11.15.11 - Authenticated (Contributor+) PHP Object Injection
Slug
powerpress
Published
2026-04-07
Title
Blubrry PowerPress < 11.15.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via powerpress and podcast Shortcodes
Slug
powerpress
Published
2026-02-13
Title
PowerPress Podcasting < 11.15.14 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
powerpress
Published
2026-05-20
Title
PowerPress Podcasting plugin by Blubrry < 11.15.11 - Authenticated (Contributor+) SQL Injection
Slug
powerpress-multisite
Published
2025-04-03
Title
Blubrry PowerPress Podcasting plugin MultiSite add-on <= 0.1.1 - Reflected Cross-Site Scripting
Slug
powers-triggers-of-woo-to-chat
Published
2025-01-07
Title
Powerful Auto Chat <= 1.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
powies-uptime-robot
Published
2025-06-05
Title
Powie's Uptime Robot <= 0.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
powies-whois
Published
2020-07-09
Title
Powie's WHOIS Domain Check < 0.9.33 - Authenticated Stored Cross-Site Scripting
Slug
powr-pack
Published
2023-11-10
Title
POWR < 2.2.0 - Contributor+ Stored XSS
Slug
ppo-call-to-actions
Published
2025-01-20
Title
PPO Call To Actions <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
ppv-live-webcams
Published
2025-02-03
Title
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams < 7.3.1 - Unauthenticated Arbitrary File Deletion
Slug
ppv-live-webcams
Published
2025-04-10
Title
Paid Videochat Turnkey Site < 7.3.12 - Authentication Bypass
Slug
ppv-live-webcams
Published
2025-10-16
Title
Paid Videochat Turnkey Site <= 7.3.23 - Admin+ Remote Code Execution
Slug
ppv-live-webcams
Published
2026-03-06
Title
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams < 7.3.21 - Authenticated (Author+) Privilege Escalation
Slug
ppv-live-webcams
Published
2026-05-26
Title
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams < 7.3.24 - Missing Authorization
Slug
ppv-live-webcams
Published
2026-05-28
Title
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams < 7.3.24 - Unauthenticated PHP Object Injection
Slug
prague-plugins
Published
2026-01-27
Title
Prague < 2.2.9 - Unauthenticated Stored Cross-Site Scripting
Slug
pramadillo-activecampaign-email-preference-center
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
pramadillo-activecampaign-email-preference-center
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
pray-for-me
Published
2024-05-24
Title
Pray For Me <= 1.0.4 - Settings Update via CSRF
Slug
pray-for-me
Published
2024-05-24
Title
Pray For Me <= 1.0.4 - Unauthenticated Stored XSS
Slug
prayer-times-anywhere
Published
2025-01-07
Title
Prayer Times Anywhere <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
prdctfltr
Published
2021-09-20
Title
Multiple WooCommerce Add-Ons - Low Priv Arbitrary Blog Options Update/Access/Deletion & Plugin's Settings Update/Export/Import