WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
tourmaster
Published
2024-12-16
Title
Tourmaster < 5.3.4 - Unauthenticated Stored XSS via Room Booking
Slug
tourmaster
Published
2025-01-09
Title
Tourmaster < 5.3.5 - Reflected XSS
Slug
tourmaster
Published
2025-02-17
Title
Tour Master - Tour Booking, Travel, Hotel < 5.3.8 - Authenticated (Subscriber+) SQL Injection via review_id Parameter
Slug
tourmaster
Published
2025-04-15
Title
Tourmaster < 5.4.1 - Reflected Cross-Site Scripting
Slug
tourmaster
Published
2025-05-21
Title
Tourmaster < 5.3.9 - Unauthenticated Local File Inclusion
Slug
tournamatch
Published
2024-06-22
Title
WordPress Plugin Tournamatch < 4.6.1 - Subscriber+ Stored XSS
Slug
tournamatch
Published
2024-06-22
Title
WordPress Plugin Tournamatch < 4.6.1 - Admin+ Stored XSS via Ladders
Slug
tournamatch
Published
2025-04-09
Title
Tournamatch <= 4.7.0 - Reflected Cross-Site Scripting
Slug
tournamatch
Published
2025-05-22
Title
Tournamatch < 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
tournament-bracket-generator
Published
2025-06-25
Title
Tournament Bracket Generator <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via bracket Shortcode
Slug
tours
Published
2025-05-15
Title
Tours < 1.0.1 - Missing Authorization
Slug
tp-education
Published
2023-08-18
Title
TP Education < 4.5 - Contributor+ Stored XSS
Slug
tp-gallery-slider
Published
2025-04-14
Title
T&P Gallery Slider <= 1.2 - Unauthenticated Stored Cross-Site Scripting
Slug
tp-woocommerce-product-gallery
Published
2025-11-19
Title
Multiple Plugins and Themes - Contributor+ DOM-Based Stored XSS via lightGallery Library
Slug
tp2wp-importer
Published
2026-02-25
Title
TP2WP Importer <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea
Slug
tpg-get-posts
Published
2024-12-16
Title
TPG Get Posts <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
tpg-redirect
Published
2023-11-09
Title
TPG Redirect < 1.0.8 - CSRF
Slug
tplayer-html5-audio-player-with-playlist
Published
2025-08-15
Title
tPlayer <= 1.2.1.6 - Unauthenticated SQL Injection
Slug
tr-easy-google-analytics
Published
2021-08-09
Title
Titan Framework <= 1.12.1 - Reflected Cross-Site Scripting (XSS)
Slug
tr-timthumb
Published
2025-12-05
Title
TR Timthumb <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
track-everything
Published
2025-06-27
Title
Track Everything <= 2.0.1 - Cross-Site Request Forgery
Slug
track-geolocation-of-users-using-contact-form-7
Published
2023-11-29
Title
Track Geolocation Of Users Using Contact Form 7 < 2.1 - Admin+ Stored XSS
Slug
track-logins
Published
2025-01-27
Title
Track Logins <= 1.0 - Admin+ SQL Injection
Slug
track-page-scroll
Published
2025-02-16
Title
Track Page Scroll <= 1.0.2 - Reflected Cross-Site Scripting
Slug
track-that-stat
Published
2012-05-15
Title
Track That Stat < 1.1.0 - Cross Site Scripting