WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
text-to-audio
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
text-to-speech-tts
Published
2026-04-03
Title
Text to Speech (TTS) by Mementor < 1.9.9 - Unauthenticated Remote Database Access
Slug
text-toggle
Published
2026-03-20
Title
Text Toggle <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
Slug
textboxes
Published
2024-10-24
Title
Textboxes <= 0.1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
textbuilder
Published
2025-10-02
Title
TextBuilder 1.0.0 - 1.1.1 - Cross-Site Request Forgery to Privilege Escalation via Account Takeover
Slug
texteller
Published
2025-01-16
Title
Texteller <= 1.3.0 - Reflected Cross-Site Scripting
Slug
textme-sms-integration
Published
2021-08-24
Title
TextME SMS < 1.8.9 - Authenticated Stored XSS
Slug
textme-sms-integration
Published
2023-11-23
Title
TextMe SMS < 1.9.1 - Subscriber+ Settings Update
Slug
textme-sms-integration
Published
2025-04-03
Title
TextMe SMS < 1.9.2 - Missing Authorization
Slug
textp2p-texting-widget
Published
2026-04-21
Title
TextP2P Texting Widget <= 1.7 - Cross-Site Request Forgery to Settings Update
Slug
tf-numbers-number-counter-animaton
Published
2023-03-27
Title
TF Random Numbers < 2.0.1 - Subscriber+ Arbitrary Option Update
Slug
tf-woo-product-grid
Published
2025-09-23
Title
TF Woo Product Grid Addon For Elementor <= 1.0.1 - Unauthenticated PHP Object Injection
Slug
tgg-wp-optimizer
Published
2025-03-28
Title
TGG WP Optimizer <= 1.25 - Admin+ Stored XSS
Slug
th-variation-swatches
Published
2025-01-22
Title
Variation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Reset
Slug
th-wishlist
Published
2025-11-24
Title
Wishlist for WooCommerce < 1.1.4 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
Slug
th23-social
Published
2022-04-19
Title
th23 Social <= 1.2.0 - Admin+ Stored Cross-Site Scripting
Slug
thai-lottery-widget
Published
2025-12-04
Title
Thai Lottery Widget <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
thank-me-later
Published
2022-03-28
Title
Thank Me Later <= 3.3.4 - Admin+ Stored Cross-Site Scripting
Slug
thanks-you-counter-button
Published
2014-08-01
Title
Thank You Counter Button - Multiple Stored Cross-Site Scripting (XSS)
Slug
thanks-you-counter-button
Published
2014-08-01
Title
Thank You Counter Button <= 1.8.2 - Cross-Site Scripting (XSS)
Slug
the-bucketlister
Published
2026-02-06
Title
The Bucketlister <= 0.1.5 - Authenticated (Contributor+) SQL Injection via `category` and `id` Shortcode Attributes
Slug
the-bucketlister
Published
2026-02-06
Title
The Bucketlister <= 0.1.5 - Missing Authorization to Authenticated (Subscriber+) Bucket List Modification
Slug
the-buffer-button
Published
2022-01-18
Title
The Buffer Button <= 1.0 - Authenticated Stored Cross Site Scripting (XSS)
Slug
the-casengo-chat-widget
Published
2025-09-22
Title
Casengo Live Chat Support <= 2.1.4 - Cross-Site Request Forgery
Slug
the-countdown
Published
2025-06-25
Title
The Countdown <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via clientId Parameter