WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
ultimate-post
Published
2026-03-03
Title
PostX < 5.0.9 - Admin+ SSRF via REST API Endpoints
Slug
ultimate-post
Published
2026-04-15
Title
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX < 5.0.6 - Missing Authorization to Limited Post Meta Modification
Slug
ultimate-post
Published
2026-07-08
Title
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites < 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute
Slug
ultimate-post
Published
2026-07-23
Title
Post Grid Gutenberg Blocks < 5.0.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute
Slug
ultimate-post
Published
2026-08-05
Title
PostX < 5.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block
Slug
ultimate-post
Published
2026-09-21
Title
PostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API
Slug
ultimate-post
Published
2026-10-09
Title
Post Grid Gutenberg Blocks < 5.1.1 - Unauthenticated Stored Cross-Site Scripting via display_name User Field
Slug
ultimate-post-kit
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
ultimate-post-kit
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
ultimate-post-kit
Published
2024-06-27
Title
Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) < 3.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Count (Static) Widget
Slug
ultimate-post-kit
Published
2025-12-10
Title
Ultimate Post Kit < 4.0.16 – Unauthenticated Arbitrary Post Content Disclosure
Slug
ultimate-post-kit
Published
2026-03-18
Title
Ultimate Post Kit Addons for Elementor < 4.0.22 - Missing Authorization
Slug
ultimate-post-kit
Published
2026-08-08
Title
BdThemes Multiple Plugins - XSS via 'display_id' from Sigmative API
Slug
ultimate-post-kit
Published
2026-10-08
Title
Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets < 4.5.6 - Missing Authorization
Slug
ultimate-posts-widget
Published
2023-07-27
Title
Multiple Plugins from Inisev - Subscriber+ Plugin Installation
Slug
ultimate-posts-widget
Published
2023-07-27
Title
Multiple Plugins from Inisev - Plugin Installation via CSRF
Slug
ultimate-posts-widget
Published
2024-02-13
Title
Ultimate Posts Widget < 2.3.1 - Admin+ Stored XSS
Slug
ultimate-product-catalog
Published
2016-06-17
Title
Product Catalog <= 3.8.1 - Privilege Escalation
Slug
ultimate-product-catalogue
Published
2015-04-22
Title
Ultimate Product Catalogue <= 3.1.1 - Unauthenticated File Upload
Slug
ultimate-product-catalogue
Published
2015-04-23
Title
Ultimate Product Catalogue <= 3.1.2 - Unauthenticated SQL Injection
Slug
ultimate-product-catalogue
Published
2015-04-23
Title
Ultimate Product Catalogue <= 3.1.2 - Unauthenticated SQL Injection
Slug
ultimate-product-catalogue
Published
2015-05-04
Title
Ultimate Product Catalogue <= 3.1.4 - Multiple Vulnerabilities
Slug
ultimate-product-catalogue
Published
2016-07-29
Title
Ultimate Product Catalogue <= 3.9.8 - Unauthenticated Blind SQL Injection
Slug
ultimate-product-catalogue
Published
2017-06-27
Title
Ultimate Product Catalogue <= 4.2.2 - Authenticated SQL Injection
Slug
ultimate-product-catalogue
Published
2022-01-06
Title
Ultimate Product Catalog < 5.0.26 - Subscriber+ Arbitrary Product Creation & Settings Update