WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
sunshine-photo-cart
Published
2026-10-22
Title
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers < 3.8 - Missing Authorization
Slug
sunshine-photo-cart
Published
2026-10-15
Title
Sunshine Photo Cart < 3.7.5 - Unauthenticated PHP Object Injection via 'key' Parameter
Slug
super-addons-for-elementor
Published
2024-10-31
Title
Super Addons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
super-blank
Published
2025-09-23
Title
Super Blank < 1.3.0 - Authenticated (Subscriber+) Arbitrary Content Deletion
Slug
super-block-slider
Published
2025-01-24
Title
Super Block Slider < 2.8 - Missing Authorization
Slug
super-captcha
Published
2014-08-01
Title
Super CAPTCHA <= 2.2.4 - SQL Injection
Slug
super-custom-login
Published
2026-02-03
Title
Super Custom Login <= 1.1 - Missing Authorization
Slug
super-forms
Published
2021-01-28
Title
Super Forms < 4.9.703 - Unauthenticated PHP File Upload to RCE
Slug
super-forms
Published
2022-01-31
Title
Superforms < 6.0.4 - Reflected Cross-Site Scripting
Slug
super-forms
Published
2026-07-09
Title
Super Forms < 6.3.314 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
Slug
super-forms
Published
2026-08-24
Title
Super Forms – Drag & Drop Form Builder < 6.3.317 - Unauthenticated Arbitrary File Read
Slug
super-forms
Published
2026-09-30
Title
Super Forms < 6.3.317 - Unauthenticated Privilege Escalation via 'role' Parameter
Slug
super-forms
Published
2026-09-30
Title
Super Forms < 6.3.317 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
Slug
super-forms
Published
2026-10-01
Title
Super Forms – Drag & Drop Form Builder < 6.3.317 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login
Slug
super-forms
Published
2026-10-01
Title
Super Forms < 6.3.317 - Unauthenticated Arbitrary File Read via 'sfgtfi' Parameter
Slug
super-forms
Published
2026-10-07
Title
Super Forms < 6.3.317 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute
Slug
super-forms
Published
2026-10-07
Title
Super Forms < 6.3.317 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter
Slug
super-forms-bundle
Published
2021-01-28
Title
Super Forms < 4.9.703 - Unauthenticated PHP File Upload to RCE
Slug
super-interactive-maps
Published
2020-10-21
Title
SuperStoreFinder Plugins - Unauthenticated Arbitrary File Upload
Slug
super-interactive-maps
Published
2021-03-08
Title
SuperStoreFinder & SuperInteractiveMaps - Unauthenticated SQL Injections
Slug
super-interactive-maps
Published
2026-01-08
Title
Super Interactive Maps <= 2.3 - Reflected Cross-Site Scripting
Slug
super-notes
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
super-notes
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
super-payments
Published
2026-10-07
Title
Super Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook Signature
Slug
super-progressive-web-apps
Published
2021-06-29
Title
Super Progressive Web Apps < 2.1.12 - Authenticated (Low Privileged) Arbitrary File Upload to RCE