WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
siteorigin-panels
Published
2025-02-28
Title
Page Builder by SiteOrigin < 2.31.5 - Contributor+ Stored XSS
Slug
siteorigin-panels
Published
2026-03-02
Title
Page Builder by SiteOrigin < 2.34.0 - Contributor+ Local File Inclusion
Slug
sitepact-klaviyo-contact-form-7
Published
2024-02-15
Title
Sitepact's Contact Form 7 Extension For Klaviyo < 3.0.0 - Unauthenticated SQL Injection
Slug
sitepress-multilingual-cms
Published
2015-03-12
Title
WPML < 3.1.9 - Multiple Vulnerabilities (Including SQLi)
Slug
sitepress-multilingual-cms
Published
2015-09-02
Title
WPML 2.9.3-3.2.6 - Cross-Site Scripting (XSS) in Accept-Language Header
Slug
sitepress-multilingual-cms
Published
2018-10-08
Title
WPML < 4.0 - Unauthenticated Stored Cross-Site Scripting (XSS)
Slug
sitepress-multilingual-cms
Published
2020-03-09
Title
WPML < 4.3.7 - Authenticated Cross Site Request Forgery leading to Remote Code Execution
Slug
sitepress-multilingual-cms
Published
2022-11-09
Title
WPML < 4.5.14 - CSRF
Slug
sitepress-multilingual-cms
Published
2022-11-09
Title
WPML < 4.5.11 - Subscriber+ Settings Update
Slug
sitepress-multilingual-cms
Published
2022-11-09
Title
WPML < 4.5.11 - Subscriber+ Translation Job Status Update
Slug
sitepress-multilingual-cms
Published
2023-04-16
Title
WPML Multilingual CMS < 4.6.1 - Reflected Cross-Site Scripting
Slug
sitepress-multilingual-cms
Published
2024-08-21
Title
WPML Multilingual CMS < 4.6.13 - Contributor+ RCE via Twig Server-Side Template Injection
Slug
sitepress-multilingual-cms
Published
2025-05-01
Title
WPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode
Slug
siteseo
Published
2025-08-26
Title
SiteSEO – SEO Simplified < 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Broken Regex Expression
Slug
siteseo
Published
2025-10-31
Title
SiteSEO < 1.3.2 - Author+ Plugin Settings Update
Slug
siteseo
Published
2025-11-18
Title
SiteSEO – SEO Simplified < 1.3.3 - Sensitive Post Meta Disclosure via IDOR
Slug
siteseo
Published
2025-11-18
Title
SiteSEO – SEO Simplified < 1.3.3 - Authenticated Settings Reset
Slug
sitespeaker-widget
Published
2025-09-22
Title
SiteNarrator Text-to-Speech Widget <= 1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
sitesupercharger
Published
2022-04-11
Title
SiteSuperCharger < 5.2.0 - Unauthenticated SQLi
Slug
sitetweet-tweets-user-behaviors-on-your-site-on-twitter
Published
2024-06-11
Title
Sitetweet <= 0.2 - Stored XSS via CSRF
Slug
sitewide-notice-wp
Published
2021-08-02
Title
Sitewide Notice WP < 2.3 - Admin+ Stored XSS
Slug
sitewide-notice-wp
Published
2025-12-15
Title
Sitewide Notice WP < 2.4.2 - Missing Authorization
Slug
sk-wp-settings-backup
Published
2024-11-13
Title
SK WP Settings Backup <= 1.0 - Cross-Site Request Forgery to PHP Object Injection
Slug
skaut-bazar
Published
2021-08-13
Title
Skaut bazar < 1.3.3 - Reflected Cross-Site Scripting
Slug
sketchfab-oembed
Published
2024-06-21
Title
Sketchfab Embed <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting