WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
ultimate-taxonomy-manager
Published
2023-10-13
Title
Ultimate Taxonomy Manager <= 2.0 - Reflected XSS
Slug
ultimate-tinymce
Published
2014-08-01
Title
TinyMCE 3.5 - swfupload Cross-Site Scripting
Slug
ultimate-tinymce
Published
2024-10-29
Title
Ultimate TinyMCE <= 5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
ultimate-twitter-profile-widget
Published
2025-08-23
Title
Ultimate twitter profile widget <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
ultimate-under-construction
Published
2024-04-30
Title
Ultimate Under Construction < 1.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
ultimate-viral-quiz
Published
2025-10-02
Title
Ultimate Viral Quiz <= 1.0 - Cross-Site Request Forgery to Settings Update
Slug
ultimate-watermark
Published
2025-09-22
Title
Ultimate Watermark < 1.1.1 - Missing Authorization
Slug
ultimate-weather-plugin
Published
2014-04-25
Title
Ultimate Weather Plugin <= 1.0 - Unauthenticated Reflected XSS
Slug
ultimate-widgets-light
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
ultimate-widgets-light
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
ultimate-widgets-light
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
ultimate-woocommerce-auction-pro
Published
2025-05-01
Title
Ultimate Auction Pro < 1.5.3 - Unauthenticated SQL Injection via 'auction_id'
Slug
ultimate-wp-mail
Published
2025-04-09
Title
Ultimate WP Mail <= 1.3.9 - Open Redirect
Slug
ultimate-wp-mail
Published
2025-05-07
Title
Ultimate WP Mail < 1.3.5 - Cross-Site Request Forgery
Slug
ultimate-wp-mail
Published
2025-05-07
Title
Ultimate WP Mail < 1.3.5 - Authenticated (Contributor+) SQL Injection
Slug
ultimate-wp-mail
Published
2025-06-05
Title
Ultimate WP Mail < 1.3.6 - Missing Authorization
Slug
ultimate-wp-mail
Published
2025-07-15
Title
Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function
Slug
ultimate-wp-mail
Published
2025-09-22
Title
Ultimate WP Mail < 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
ultimate-wp-query-search-filter
Published
2023-02-15
Title
Ultimate WP Query Search Filter <= 1.0.10 - Contributor+ XSS
Slug
ultimate-youtube-video-player
Published
2024-11-20
Title
Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Playlist/Video Deletion
Slug
ultimate-youtube-video-player
Published
2024-11-21
Title
Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Setting Exposure
Slug
ultimate_vc_addons
Published
2017-05-15
Title
Ultimate Addons for Visual Composer < 3.16.12 - Authenticated XSS, CSRF, RCE
Slug
ultimate_vc_addons
Published
2023-10-19
Title
Ultimate Addons for WPBakery Page Builder < 3.19.15 - Authenticated(Contributor+) Local File Inclusion
Slug
ultimate_vc_addons
Published
2023-12-26
Title
Ultimate Addons for WPBakery < 3.19.18 - Cross-Site Request Forgery
Slug
ultimatewoo
Published
2021-05-07
Title
UltimateWoo <= 0.1.10 - PHP Object Injection