WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
the-plus-addons-for-elementor-page-builder
Published
2025-09-22
Title
The Plus Addons for Elementor < 6.3.16 - Author+ Stored XSS
Slug
the-post-grid
Published
2023-02-23
Title
The Post Grid <= 5.0.4 - Settings Update via CSRF
Slug
the-post-grid
Published
2023-08-07
Title
The Post Grid < 7.2.8 - Block CSS Update via CSRF
Slug
the-post-grid
Published
2024-04-30
Title
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid < 7.7.0 - Missing Authorization
Slug
the-post-grid
Published
2024-06-06
Title
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid < 7.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
the-post-grid
Published
2024-07-01
Title
The Post Grid < 7.7.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via section title tag
Slug
the-post-grid
Published
2024-07-04
Title
The Post Grid < 7.7.5 - Missing Authorization via save_block_css
Slug
the-post-grid
Published
2024-07-04
Title
The Post Grid < 7.7.5 - Missing Authorization via AJAX
Slug
the-post-grid
Published
2024-07-04
Title
The Post Grid < 7.7.5 - Missing Authorization via REST API
Slug
the-post-grid
Published
2024-08-28
Title
The Post Grid < 7.7.12 - Authenticated (Contributor+) Information Disclosure
Slug
the-post-grid
Published
2024-09-09
Title
The Post Grid < 7.5.0 - Editor+ Stored XSS via Grid Creation
Slug
the-post-grid
Published
2025-03-27
Title
The Post Grid < 7.7.18 - Contributor+ Local File Inclusion
Slug
the-sorter
Published
2021-08-22
Title
The Sorter <= 1.0 - Authenticated SQL Injection
Slug
the-tech-tribe
Published
2025-09-26
Title
The Tribal < 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
the-tech-tribe
Published
2025-09-26
Title
The Tribal < 1.3.4 - Unauthenticated Sensitive Information Exposure
Slug
the-tooltip
Published
2026-01-08
Title
The Tooltip <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
the-total-book-project
Published
2025-11-10
Title
The Total Book Project < 1.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation
Slug
the-very-simple-vimeo-shortcode
Published
2023-03-02
Title
Simple Vimeo Shortcode <= 2.9.1 - Contributor+ Stored XSS
Slug
the-visitor-counter
Published
2025-03-28
Title
The Visitor Counter <= 1.4.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
the-world
Published
2025-04-09
Title
The World <= 0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
theasys
Published
2025-02-03
Title
Theasys <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
theatre
Published
2023-11-16
Title
Theater for WordPress < 0.18.4 - Admin+ Stored XSS
Slug
theatre
Published
2024-11-20
Title
Theater for WordPress < 0.18.7 - Reflected Cross-Site Scripting
Slug
theatre
Published
2025-04-01
Title
Theater for WordPress < 0.18.8 - Missing Authorization
Slug
theatre
Published
2025-09-22
Title
Theater for WordPress < 0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting