WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
sendgrid-email-delivery-simplified
Published
2021-07-21
Title
SendGrid <= 1.11.8 - Authenticated Authorization Bypass
Slug
sendit
Published
2014-08-01
Title
SendIt <= 1.5.9 - Blind SQL Injection
Slug
sendit
Published
2014-09-19
Title
Sendit < 2.1.1 - SQL Injection
Slug
sendit
Published
2021-05-27
Title
Sendit WP Newsletter <= 2.5.1 - Authenticated (admin+) SQL Injection
Slug
sendmachine
Published
2026-04-21
Title
Sendmachine for WordPress < 2.0.0 - Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests
Slug
sendpress
Published
2015-07-23
Title
SendPress Newsletters < 1.2 - Authenticated SQL Injection
Slug
sendpress
Published
2020-07-13
Title
SendPress Newsletter < 1.20.7.13 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
sendpress
Published
2023-10-02
Title
SendPress Newsletters <= 1.26.1.20 - Admin+ Stored XSS
Slug
sendpress
Published
2023-09-05
Title
SendPress Newsletters <= 1.26.1.20 - CSRF
Slug
sendpress
Published
2023-11-06
Title
SendPress Newsletters < 1.23.11.6 - Contributor+ Stored XSS
Slug
sendpress
Published
2023-11-07
Title
SendPress Newsletters < 1.24.8.19 - Reflected XSS
Slug
sendpress
Published
2024-03-18
Title
SendPress Newsletters <= 1.23.11.6 - Admin+ Stored XSS via Form Settings
Slug
sendpress
Published
2024-03-18
Title
SendPress Newsletters <= 1.23.11.6 - Admin+ Stored XSS via Settings
Slug
sendpulse-email-marketing-newsletter
Published
2025-02-03
Title
SendPulse Email Marketing Newsletter < 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
sendpulse-email-marketing-newsletter
Published
2025-05-07
Title
SendPulse Email Marketing Newsletter < 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
sendpulse-email-marketing-newsletter
Published
2025-12-05
Title
SendPulse Email Marketing Newsletter < 2.2.2 - Authenticated (Subscriber+) Information Exposure
Slug
sendpulse-email-marketing-newsletter
Published
2026-07-31
Title
SendPulse Email Marketing Newsletter < 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via _sp_form_code Post Meta
Slug
sendpulse-web-push
Published
2023-10-16
Title
SendPulse Free Web Push < 1.3.2 - CSRF
Slug
sendpulse-web-push
Published
2024-10-16
Title
SendPulse Free Web Push < 1.3.7 - Unauthenticated Stored Cross-Site Scripting
Slug
sendsms
Published
2024-12-17
Title
SendSMS <= 1.2.9 - Reflected Cross-Site Scripting
Slug
sendy
Published
2026-01-28
Title
Sendy < 3.4.3 - Missing Authorization
Slug
sensei-lms
Published
2022-08-04
Title
Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API
Slug
sensei-lms
Published
2022-08-04
Title
Sensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDOR
Slug
sensei-lms
Published
2023-12-22
Title
Sensei LMS < 4.18.0 - Contributor+ Stored XSS
Slug
sensei-lms
Published
2024-06-06
Title
Sensei LMS <= 4.23.1 & Sensei Pro (WC Paid Courses) <= 4.24.0.1.24.0 - Unauthenticated Rewrite Rules Flushing