WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
shortcode-for-font-awesome
Published
2023-01-24
Title
Shortcode for Font Awesome < 1.4.1 - Contributor+ Stored XSS
Slug
shortcode-for-redirection
Published
2024-11-08
Title
Redirecter <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
shortcode-gallery-for-matterport-showcase
Published
2023-06-15
Title
WP Matterport Shortcode < 2.1.5 - Contributor+ Stored XSS
Slug
shortcode-gallery-for-matterport-showcase
Published
2023-09-25
Title
WP Matterport Shortcode < 2.1.7 - Reflected XSS
Slug
shortcode-gallery-for-matterport-showcase
Published
2023-09-25
Title
WP Matterport Shortcode < 2.1.8 - Contributor+ Stored XSS via shortcode
Slug
shortcode-gallery-for-matterport-showcase
Published
2024-04-11
Title
WP Matterport Shortcode < 2.2.0 - Cross-Site Request Forgery
Slug
shortcode-generator
Published
2025-07-08
Title
Shortcode Generator <= 1.1 - Reflected Cross-Site Scripting
Slug
shortcode-imdb
Published
2023-07-11
Title
Shortcode IMDB <= 6.0.8 - Cross-Site Request Forgery
Slug
shortcode-imdb
Published
2023-04-19
Title
Shortcode IMDB <= 6.0.8 - Admin+ SQLi
Slug
shortcode-in-comment
Published
2025-01-16
Title
Shortcode in Comment <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
shortcode-menu
Published
2023-10-29
Title
Shortcode Menu <= 3.2 - Contributor+ Stored Cross-Site Scripting
Slug
shortcode-ninja
Published
2014-04-25
Title
Shortcode Ninja <= 1.4 - Unauthenticated Reflected XSS
Slug
shortcode-redirect
Published
2014-08-01
Title
Shortcode Redirect <= 1.0.01 - Stored Cross Site Scripting
Slug
shortcode-redirect
Published
2025-08-14
Title
Shortcode Redirect < 1.0.03 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
shortcode-support-for-elementor-templates
Published
2024-10-08
Title
Shortcode For Elementor Templates <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
shortcode-to-display-post-and-user-data
Published
2024-01-16
Title
Display custom fields in the frontend – Post and User Profile Fields < 1.3.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Meta Disclosure
Slug
shortcode-to-display-post-and-user-data
Published
2024-01-16
Title
Display custom fields in the frontend – Post and User Profile Fields < 1.3.0 - Authenticated (Contributor+) Code Injection
Slug
shortcode-to-display-post-and-user-data
Published
2024-01-16
Title
Display custom fields in the frontend – Post and User Profile Fields < 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via vg_display_data
Slug
shortcode-variables
Published
2024-07-02
Title
Snippet Shortcodes < 4.1.5 - Cross-Site Request Forgery
Slug
shortcode-variables
Published
2024-12-11
Title
Snippet Shortcodes < 4.1.7 - Authenticated (Subscriber+) Shortcode Deletion
Slug
shortcodehub
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
shortcodehub
Published
2025-08-22
Title
ShortcodeHub <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via author_link_target Parameter
Slug
shortcoder
Published
2023-12-06
Title
Shortcoder < 6.3.1 - Subscriber+ Unauthorised AJAX Call
Slug
shortcodes-anywhere
Published
2024-10-09
Title
Shortcodes AnyWhere <= 1.0.1 - Unauthenticated Arbitrary Shortcode Execution
Slug
shortcodes-bootstrap
Published
2025-11-20
Title
Shortcodes Bootstrap <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting