WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
svg-support
Published
2022-09-05
Title
SVG Support < 2.5 - Author+ Stored Cross-Site Scripting
Slug
svg-support
Published
2022-11-16
Title
SVG Support 2.5-2.5.1 - Author+ Stored XSS
Slug
svg-support
Published
2024-07-17
Title
SVG Support < 2.5.8 - Author+ Cross-Site Scripting via SVG
Slug
svg-support
Published
2025-02-21
Title
SVG Support < 2.5.11 - Author+ Stored XSS via SVG File Upload
Slug
svg-support
Published
2025-02-24
Title
SVG Support < 2.5.9 - Stored Cross-Site Scripting via Vulnerability Dependency
Slug
svg-support
Published
2026-05-27
Title
SVG Support < 2.5.15 - Contributor+ Missing Authorization
Slug
svg-support
Published
2026-07-24
Title
SVG Support < 2.5.17 - Author+ Stored XSS via .svgz Sanitization Bypass
Slug
svg-uploads-support
Published
2024-01-23
Title
SVG Uploads Support <= 2.1.1 - Author+ Stored XSS via SVG
Slug
svg-vector-icon-plugin
Published
2019-08-09
Title
WP SVG Icons <= 3.2.2 - Cross-Site Request Forgery (CSRF) leading to RCE
Slug
svg-vector-icon-plugin
Published
2022-05-18
Title
WP SVG Icons <= 3.2.3 - Admin+ Remote Code Execution (RCE)
Slug
svgator
Published
2023-11-28
Title
SVGator – Add Animated SVG Easily < 1.2.5 - API Token Update/Deletion & Import Projects via CSRF
Slug
svgator
Published
2024-05-24
Title
SVGator < 1.3.3 - Stored XSS via SVG Upload
Slug
svgmagic
Published
2024-05-24
Title
SVGMagic <= 1.1 - Stored XSS via SVG Upload
Slug
svgplus
Published
2024-11-15
Title
SVGPlus <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
svs-pricing-tables
Published
2024-04-29
Title
SVS Pricing Tables <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Slug
svs-pricing-tables
Published
2024-04-29
Title
SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Edit/Creation
Slug
svs-pricing-tables
Published
2024-04-29
Title
SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Deletion
Slug
svt-simple
Published
2024-11-04
Title
SVT Simple <= 1.0.1 - Reflected Cross-Site Scripting
Slug
sw-contact-form
Published
2024-10-18
Title
SW Contact Form <= 1.0 - Authenticated (Subscriber+) SQL Injection
Slug
sw_ajax_woocommerce_search
Published
2020-10-30
Title
SW Ajax WooCommerce Search < 1.2.8 - Unauthenticated Reflected XSS & XFS
Slug
sw_core
Published
2026-05-26
Title
SW Core <= 1.7.18 - Authenticated (Contributor+) Local File Inclusion
Slug
swatchly
Published
2023-03-30
Title
Swatchly – WooCommerce Variation Swatches for Products < 1.2.1 - Cross-Site Request Forgery
Slug
swatchly
Published
2025-04-09
Title
Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) 1.2.8 - 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
Slug
swatchly
Published
2026-08-19
Title
Swatchly – Product Variation Swatches for WooCommerce < 1.4.14 - Unauthenticated Stored Cross-Site Scripting
Slug
sweepwidget
Published
2025-01-06
Title
SweepWidget Contests, Giveaways, Photo Contests, Competitions <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting