WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
statpresscn
Published
2011-01-21
Title
Statpresscn <= 1.9.0 - Multiple XSS
Slug
statpresscn
Published
2025-01-16
Title
StatPressCN <= 1.9.1 - Reflected Cross-Site Scripting
Slug
stats-counter
Published
2017-03-01
Title
Analytics Stats Counter Statistics - Unauthenticated PHP Object Injection
Slug
stax
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
stax
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
stax-addons-for-elementor
Published
2024-04-04
Title
Elementor Addons, Widgets and Enhancements – Stax <= 1.4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
stax-buddy-builder
Published
2024-11-12
Title
BuddyPress Builder for Elementor – BuddyBuilder < 1.8.0 - Contributor+ Post Disclosure
Slug
steam-group-viewer
Published
2021-06-28
Title
Steam Group Viewer <= 2.1 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
stedb-forms
Published
2025-03-24
Title
STEdb Forms <= 1.0.4 - Authenticated (Administrator+) SQL Injection
Slug
steel
Published
2024-11-15
Title
Steel <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn Shortcode
Slug
stellissimo-text-box
Published
2024-06-06
Title
Stellissimo Text Box <= 1.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Slug
stencies
Published
2025-03-18
Title
Stencies <= 0.58 - Reflected Cross-Site Scripting
Slug
step-by-step
Published
2024-10-30
Title
Step by Step <= 0.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
stepbyteservice-openstreetmap
Published
2024-03-28
Title
OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) < 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
stepbyteservice-openstreetmap
Published
2024-06-25
Title
Various Plugins <= Various Version - Use of Polyfill.io
Slug
stepbyteservice-openstreetmap
Published
2025-07-18
Title
OpenStreetMap for Gutenberg and WPBakery Page Builder <= 1.2.0 - Contributor+ Stored XSS
Slug
stetic
Published
2021-11-29
Title
Stetic < 1.0.9 - CSRF to Stored Cross-Site Scripting
Slug
stickeasy-protected-contact-form
Published
2026-02-13
Title
StickEasy Protected Contact Form < 1.0.2 - Unauthenticated Information Disclosure
Slug
sticky
Published
2026-05-19
Title
Sticky <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attribute
Slug
sticky-action-buttons
Published
2026-01-06
Title
Sticky Action Buttons <= 1.1 - Cross-Site Request Forgery to Plugin Settings Update
Slug
sticky-ad-bar
Published
2023-02-15
Title
Sticky Ad Bar <= 1.3.1 - Admin+ Stored XSS
Slug
sticky-add-to-cart-for-woo
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
sticky-add-to-cart-woo
Published
2025-04-01
Title
Simple Sticky Add To Cart For WooCommerce <= 1.4.9 - Missing Authorization
Slug
sticky-banner
Published
2024-05-10
Title
Sticky banner < 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
sticky-buttons
Published
2023-05-22
Title
Multiple Plugins from Wow-Company - Reflected XSS