WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
the-total-book-project
Published
2025-11-10
Title
The Total Book Project < 1.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation
Slug
the-very-simple-vimeo-shortcode
Published
2023-03-02
Title
Simple Vimeo Shortcode <= 2.9.1 - Contributor+ Stored XSS
Slug
the-visitor-counter
Published
2025-03-28
Title
The Visitor Counter <= 1.4.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
the-welcomizer
Published
2026-09-18
Title
The Welcomizer < 999.0 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter
Slug
the-world
Published
2025-04-09
Title
The World <= 0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
theaisle-core
Published
2026-03-16
Title
The Aisle Core <= 2.0.5 - Unauthenticated Local File Inclusion
Slug
theasys
Published
2025-02-03
Title
Theasys <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
theatre
Published
2023-11-16
Title
Theater for WordPress < 0.18.4 - Admin+ Stored XSS
Slug
theatre
Published
2024-11-20
Title
Theater for WordPress < 0.18.7 - Reflected Cross-Site Scripting
Slug
theatre
Published
2025-04-01
Title
Theater for WordPress < 0.18.8 - Missing Authorization
Slug
theatre
Published
2025-09-22
Title
Theater for WordPress < 0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
theatre
Published
2025-11-13
Title
Theater for WordPress < 0.19 - Missing Authorization
Slug
theatre
Published
2025-12-28
Title
Theater for WordPress < 0.19.1 - Missing Authorization
Slug
theatre
Published
2026-02-25
Title
Theater for WordPress < 0.19.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
thebing-snippet
Published
2025-09-12
Title
Fidelo Snippet <= 1.12 - Reflected Cross-Site Scripting
Slug
thebooking
Published
2025-07-30
Title
TheBooking <= 1.4.4 - Missing Authorization
Slug
thecartpress
Published
2011-12-31
Title
TheCartPress < 1.1.6 - Cross-Site Scripting (XSS)
Slug
thecartpress
Published
2014-08-01
Title
TheCartPress 1.1.1 - Remote File Inclusion
Slug
thecartpress
Published
2015-04-29
Title
TheCartPress < 1.3.9.3 - Multiple Vulnerabilities
Slug
thecartpress
Published
2021-10-05
Title
TheCartPress eCommerce Shopping Cart <= 1.5.3.6 - Unauthenticated Arbitrary Admin Account Creation
Slug
thegem-elements
Published
2025-10-16
Title
TheGem Theme Elements (for WPBakery) < 5.10.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
thegem-elements
Published
2025-10-13
Title
TheGem Theme Elements (for WPBakery) < 5.10.5.2 - Unauthenticated Local File Inclusion
Slug
thegem-elements
Published
2026-01-10
Title
TheGem Theme Elements (for WPBakery) < 5.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
thegem-elements-elementor
Published
2025-10-12
Title
TheGem Theme Elements (for Elementor) < 5.10.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
thegem-elements-elementor
Published
2025-10-12
Title
TheGem Theme Elements (for Elementor) < 5.10.5.2 - Authenticated (Contributor+) Local File Inclusion