WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
text-hover
Published
2022-03-28
Title
Text Hover < 4.2 - Admin+ Stored Cross-Site Scripting
Slug
text-selection-color
Published
2025-03-28
Title
Text Selection Color <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
text-snippet
Published
2026-04-21
Title
Text Snippets <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'w' Shortcode Attribute
Slug
text-styler
Published
2026-09-19
Title
Text Styler <= 1.1.1 - Contributor+ Stored XSS
Slug
text-to-audio
Published
2025-09-22
Title
Text To Speech TTS Accessibility < 1.9.31 - Missing Authorization
Slug
text-to-audio
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
text-to-speech-tts
Published
2026-04-03
Title
Text to Speech (TTS) by Mementor < 1.9.9 - Unauthenticated Remote Database Access
Slug
text-toggle
Published
2026-03-20
Title
Text Toggle <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
Slug
textboxes
Published
2024-10-24
Title
Textboxes <= 0.1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
textbuilder
Published
2025-10-02
Title
TextBuilder 1.0.0 - 1.1.1 - Cross-Site Request Forgery to Privilege Escalation via Account Takeover
Slug
texteller
Published
2025-01-16
Title
Texteller <= 1.3.0 - Reflected Cross-Site Scripting
Slug
textme-sms-integration
Published
2021-08-24
Title
TextME SMS < 1.8.9 - Authenticated Stored XSS
Slug
textme-sms-integration
Published
2023-11-23
Title
TextMe SMS < 1.9.1 - Subscriber+ Settings Update
Slug
textme-sms-integration
Published
2025-04-03
Title
TextMe SMS < 1.9.2 - Missing Authorization
Slug
textp2p-texting-widget
Published
2026-04-21
Title
TextP2P Texting Widget < 1.9 - Cross-Site Request Forgery to Settings Update
Slug
tf-numbers-number-counter-animaton
Published
2023-03-27
Title
TF Random Numbers < 2.0.1 - Subscriber+ Arbitrary Option Update
Slug
tf-woo-product-grid
Published
2025-09-23
Title
TF Woo Product Grid Addon For Elementor <= 1.0.1 - Unauthenticated PHP Object Injection
Slug
tgg-wp-optimizer
Published
2025-03-28
Title
TGG WP Optimizer <= 1.25 - Admin+ Stored XSS
Slug
th-advance-product-search
Published
2026-06-25
Title
Advance Product Search- Voice & Ajax Search for WooCommerce < 1.4.5 - Unauthenticated SQL Injection
Slug
th-advance-product-search
Published
2026-07-15
Title
Advance Product Search- Voice & Ajax Search for WooCommerce < 1.4.5 - Unauthenticated SQL Injection via 's' and 'match' Parameter
Slug
th-advance-product-search
Published
2026-08-19
Title
Advance Product Search- Voice & Ajax Search for WooCommerce < 1.4.9 - Unauthenticated Stored Cross-Site Scripting
Slug
th-variation-swatches
Published
2025-01-22
Title
Variation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Reset
Slug
th-wishlist
Published
2025-11-24
Title
Wishlist for WooCommerce < 1.1.4 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
Slug
th23-social
Published
2022-04-19
Title
th23 Social <= 1.2.0 - Admin+ Stored Cross-Site Scripting
Slug
thai-lottery-widget
Published
2025-12-04
Title
Thai Lottery Widget < 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes