WordPress Plugin Vulnerabilities | Page 129 | WPScan

0-9
a
b
c
d
e
f
g
h
i
j
k
l
m
n
o
p
q
r
s
t
u
v
w
x
y
z

Slug

Published

2026-06-01

Title

Support Board < 3.8.9 - Unauthenticated Privilege Escalation

Slug

Published

2022-02-28

Title

Unauthorised AJAX Calls via Freemius

Slug

Published

2023-07-18

Title

Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting

Slug

Published

2019-04-17

Title

SupportCandy <= 2.0.0 - Arbitrary File Upload

Slug

Published

2022-01-05

Title

SupportCandy < 2.2.7 - Contributor+ Stored Cross-Site Scripting

Slug

Published

2022-01-05

Title

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

Slug

Published

2022-01-05

Title

SupportCandy < 2.2.7 - CSRF to Cross-Site Scripting

Slug

Published

2022-01-05

Title

SupportCandy < 2.2.7 - Arbitrary Ticket Deletion via CSRF

Slug

Published

2022-01-05

Title

SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket Deletion

Slug

Published

2023-04-10

Title

SupportCandy < 3.1.5 - Unauthenticated SQLi

Slug

Published

2023-05-22

Title

SupportCandy < 3.1.7 - Subscriber+ SQLi

Slug

Published

2023-05-22

Title

SupportCandy < 3.1.7 - Admin+ SQLi

Slug

Published

2024-03-15

Title

SupportCandy < 3.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Slug

Published

2025-03-06

Title

SupportCandy < 3.3.1 - Support Ticket Attachments Download via IDOR

Slug

Published

2025-09-19

Title

SupportCandy < 3.3.8 - Authentication Bypass to Support Session Takeover

Slug

Published

2025-11-21

Title

SupportCandy < 3.4.2 - Cross-Site Request Forgery

Slug

Published

2026-01-23

Title

SupportCandy – Helpdesk & Customer Support Ticket System < 3.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference

Slug

Published

2026-01-30

Title

SupportCandy – Helpdesk & Customer Support Ticket System < 3.4.5 - Authenticated (Subscriber+) SQL Injection via Number Field Filter

Slug

Published

2026-01-29

Title

SupportCandy – Helpdesk & Customer Support Ticket System < 3.4.5 - Missing Authorization

Slug

Published

2026-06-17

Title

SupportCandy – Helpdesk & Customer Support Ticket System < 3.4.7 - Authenticated (Subscriber+) Insecure Direct Object Reference

Slug

Published

2026-07-10

Title

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent < 3.4.9 - Authenticated (Customer+) Stored Cross-Site Scripting

Slug

Published

2014-11-13

Title

SupportEzzy Ticket System 1.2.5 - Cross Site Scripting

Slug

Published

2016-06-28

Title

SupportFlow <= 0.6 - Stored Cross-Site Scripting (XSS)

Slug

supra-csv-parser

Published

2022-12-05

Title

Supra CSV <= 4.0.3 - Stored Cross-Site Scripting via CSRF

Slug

supreme-addons-for-beaver-builder-lite

Published

2025-07-23

Title

Supreme Addons for Beaver Builder <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_qrcodesabb Shortcode