WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
revslider
Published
2023-11-14
Title
Slider Revolution < 6.6.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
revslider
Published
2023-11-14
Title
Slider Revolution < 6.6.16 - Authenticated (Author+) Arbitrary File Upload
Slug
revslider
Published
2023-11-30
Title
Slider Revolution < 6.6.19 - Author+ Insecure Deserialization leading to RCE
Slug
revslider
Published
2024-04-08
Title
Revslider < 6.7.0 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
revslider
Published
2024-04-30
Title
Slider Revolution < 6.7.8 - Authenticated (Author+) Stored Cross-Site Scripting via htmltag Parameter
Slug
revslider
Published
2024-06-03
Title
Slider Revolution < 6.7.11 - Authenticated (Author+) Stored Cross-Site Scripting via Add Layer class, id, and title Attributes
Slug
revslider
Published
2024-06-03
Title
Slider Revolution < 6.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor wrapperid and zindex
Slug
revslider
Published
2024-05-28
Title
Slider Revolution < 6.7.0 - Missing Authorization
Slug
revslider
Published
2024-05-28
Title
Slider Revolution < 6.7.11 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
revslider
Published
2024-06-28
Title
Slider Revolution < 6.7.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
revslider
Published
2024-09-30
Title
Slider Revolution < 6.7.19 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
revslider
Published
2025-08-28
Title
Slider Revolution < 6.7.37 - Authenticated (Contributor+) Arbitrary File Read via 'used_svg' and 'used_images'
Slug
revslider
Published
2025-10-08
Title
Slider Revolution < 6.7.38 - Contributor+ Arbitrary File Read
Slug
revslider
Published
2026-05-06
Title
Slider Revolution 7.0.0 - 7.0.10 - Subscriber+ Arbitrary File Upload via _get_media_url
Slug
revslider
Published
2026-05-19
Title
Slider Revolution < 7.0.10 - Unauthenticated Sensitive Information Exposure via 'sliders/stream'
Slug
revy
Published
2024-12-02
Title
Revy <= 1.18 - Unauthenticated SQL Injection
Slug
revy
Published
2024-12-02
Title
Revy <= 1.18 - Unauthenticated Arbitrary File Upload
Slug
revy
Published
2025-04-21
Title
Revy <= 2.1 - Authenticated (Subscriber+) SQL Injection
Slug
rewardswp
Published
2026-03-20
Title
RewardsWP < 1.0.5 - Unauthenticated Privilege Escalation
Slug
rewardsystem
Published
2025-04-21
Title
SUMO Reward Points <= 30.7.0 - Unauthenticated Local File Inclusion
Slug
rewp
Published
2024-10-03
Title
Re:WP < 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
rewrite
Published
2025-03-24
Title
Rewrite <= 0.2.1 - Cross-Site Request Forgery
Slug
rexcrawler
Published
2026-03-20
Title
rexCrawler <= 1.0.15 - Reflected Cross-Site Scripting via 'url' and 'regex' Parameters
Slug
rexcrawler
Published
2026-05-26
Title
rexCrawler <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
Slug
rezgo
Published
2014-05-28
Title
Rezgo < 2.0.0 - Reflected Cross-Site Scripting