WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
tk-google-fonts
Published
2023-10-24
Title
TK Google Fonts GDPR Compliant < 2.2.12 - Missing Authorization to Font Deletion
Slug
tk-smugmug-slideshow-shortcode
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
tk-smugmug-slideshow-shortcode
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
tlitl-auto-twitter-poster
Published
2025-08-22
Title
tli.tl auto Twitter poster <= 3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
tlp-food-menu
Published
2025-01-30
Title
Food Menu – Restaurant Menu & Online Ordering for WooCommerce < 5.2.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Slug
tlp-portfolio
Published
2023-02-16
Title
Portfolio - WordPress Portfolio < 2.8.11 - Contributor+ Stored XSS
Slug
tlp-team
Published
2022-07-27
Title
WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion
Slug
tlp-team
Published
2024-09-04
Title
Team Members Showcase < 4.4.2 - Editor+ Stored XSS
Slug
tlp-team
Published
2025-02-14
Title
Team – Team Members Showcase Plugin < 5.0.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Slug
tlp-team
Published
2025-09-22
Title
Team < 5.0.7 - Missing Authorization
Slug
tlp-team
Published
2025-12-15
Title
Team < 5.0.11 - Unauthenticated SQLi
Slug
tm-islamic-helper
Published
2024-11-18
Title
TM Islamic Helper <= 1.0.1 - Reflected Cross-Site Scripting
Slug
tm-replace-howdy
Published
2025-06-19
Title
TM Replace Howdy <= 1.4.2 - Cross-Site Request Forgery
Slug
tm-woocommerce-compare-wishlist
Published
2023-09-27
Title
TM WooCommerce Compare & Wishlist <= 1.1.7 - Contributor+ Stored Cross-Site Scripting
Slug
tml-2fa
Published
2023-11-24
Title
Theme My Login 2FA < 1.2 - Lack of Rate Limiting
Slug
tmm_content_composer
Published
2025-08-19
Title
ThemeMakers Visual Content Composer <= 1.5.8 - Unauthenticated PHP Object Injection
Slug
tmm_db_migrate
Published
2015-05-15
Title
ThemeMakers Themes - Information Disclosure
Slug
tmm_paypal_checkout
Published
2025-02-26
Title
ThemeMakers PayPal Express Checkout < 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
tmm_stripe_checkout
Published
2025-02-26
Title
ThemeMakers Stripe Checkout < 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
tnc-toolbox
Published
2025-11-10
Title
TNC Toolbox: Web Performance < 2.0.0 - Unauthenticated Privilege Escalation/cPanel Account Takeover
Slug
tnc-toolbox
Published
2025-11-29
Title
TNC Toolbox: Web Performance < 2.0.5 - Missing Authorization
Slug
to-top
Published
2021-09-20
Title
Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change
Slug
toast-responsive-menu
Published
2025-09-07
Title
Toast Mobile Menu < 1.0.9 - Unauthenticated Stored Cross-Site Scripting
Slug
toast-stick-anything
Published
2024-03-29
Title
Sticky Anything <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting
Slug
toast-stick-anything
Published
2024-04-25
Title
Sticky Anything <= 2.1.5 - Missing Authorization