WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
smtp2go
Published
2026-05-27
Title
SMTP2GO for WordPress < 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate
Slug
snap-pixel
Published
2023-09-27
Title
Snap Pixel < 1.5.8 - Admin+ Stored XSS
Slug
snap-pixel
Published
2023-10-16
Title
Snap Pixel < 1.6.0 - Arbitrary Settings Update via CSRF
Slug
snapapp
Published
2014-04-25
Title
Snapapp <= 1.5 - Multiple Cross-Site Scripting (XSS)
Slug
snapshot-backup
Published
2024-08-19
Title
Snapshot Backup <= 2.1.1 - Stored XSS via CSRF
Slug
snapwidget-wp-instagram-widget
Published
2025-04-01
Title
SnapWidget Social Photo Feed Widget <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
snapwidget-wp-instagram-widget
Published
2025-09-22
Title
SnapWidget Social Photo Feed Widget <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
snazzy-archives
Published
2014-08-01
Title
snazzy-archives <= 1.7.1 - swf/tagcloud.swf tagcloud Parameter XSS
Slug
snazzy-maps
Published
2018-07-24
Title
Snazzy Maps < 1.1.5 - Multiple Cross-Site Scripting (XSS)
Slug
snazzyadmin-wp-admin-theme
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
snazzyadmin-wp-admin-theme
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
snazzyadmin-wp-admin-theme
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
sneeit-framework
Published
2025-11-24
Title
Sneeit Framework < 8.4 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback
Slug
snillrik-restaurant-menu
Published
2026-01-06
Title
Snillrik Restaurant < 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'menu_style' Shortcode Attribute
Slug
snipe-nginx-cache
Published
2025-01-16
Title
Cache Sniper for Nginx <= 1.0.4.2 - Missing Authorization
Slug
sniplets
Published
2014-08-01
Title
Sniplets 1.1.2 - (RFI/XSS/RCE) Multiple Vulnerabilities
Slug
snippy
Published
2025-01-16
Title
Snippy <= 1.4.1 - Reflected Cross-Site Scripting
Slug
snow-monkey-blocks
Published
2026-05-05
Title
Snow Monkey Blocks < 24.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' Attribute
Slug
snow-monkey-forms
Published
2023-05-15
Title
Snow Monkey Forms < 5.0.7 - Unauthenticated Path Traversal
Slug
snow-monkey-forms
Published
2026-01-27
Title
Snow Monkey Forms < 12.0.4 - Unauthenticated Arbitrary File Deletion
Slug
snow-storm
Published
2025-04-02
Title
Snow Storm < 1.4.7 - Reflected Cross-Site Scripting
Slug
snow-storm
Published
2025-03-18
Title
Snow Storm < 1.4.7 - Admin+ Stored XSS
Slug
so-called-air-quotes
Published
2025-03-28
Title
So-Called Air Quotes <= 0.1 - Unauthenticated Arbitrary Shortcode Execution
Slug
so-pinyin-slugs
Published
2023-11-07
Title
Pinyin Slugs < 2.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
so-widgets-bundle
Published
2023-11-27
Title
so-widgets-bundle < 1.51.0 - Admin+ Local File Inclusion