WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
ultimate-store-kit
Published
2025-12-30
Title
Ultimate Store Kit Elementor Addons < 2.9.5 - Missing Authorization
Slug
ultimate-store-kit
Published
2026-07-22
Title
Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor < 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
ultimate-subscribe
Published
2025-01-16
Title
Ultimate Subscribe <= 1.3 - Reflected Cross-Site Scripting
Slug
ultimate-tables
Published
2022-11-17
Title
Ultimate Tables <= 1.6.5 - Reflected Cross-Site Scripting
Slug
ultimate-taxonomy-manager
Published
2023-10-16
Title
Ultimate Taxonomy Manager <= 2.0 - Arbitrary Settings Update via CSRF
Slug
ultimate-taxonomy-manager
Published
2023-10-13
Title
Ultimate Taxonomy Manager <= 2.0 - Reflected XSS
Slug
ultimate-tinymce
Published
2014-08-01
Title
TinyMCE 3.5 - swfupload Cross-Site Scripting
Slug
ultimate-tinymce
Published
2024-10-29
Title
Ultimate TinyMCE <= 5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
ultimate-twitter-profile-widget
Published
2025-08-23
Title
Ultimate twitter profile widget <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
ultimate-under-construction
Published
2024-04-30
Title
Ultimate Under Construction < 1.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
ultimate-viral-quiz
Published
2025-10-02
Title
Ultimate Viral Quiz <= 1.0 - Cross-Site Request Forgery to Settings Update
Slug
ultimate-watermark
Published
2025-09-22
Title
Ultimate Watermark < 1.1.1 - Missing Authorization
Slug
ultimate-weather-plugin
Published
2014-04-25
Title
Ultimate Weather Plugin <= 1.0 - Unauthenticated Reflected XSS
Slug
ultimate-widgets-light
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
ultimate-widgets-light
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
ultimate-widgets-light
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
ultimate-woocommerce-auction-pro
Published
2025-05-01
Title
Ultimate Auction Pro < 1.5.3 - Unauthenticated SQL Injection via 'auction_id'
Slug
ultimate-woocommerce-auction-pro
Published
2026-06-01
Title
Ultimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_auctions_bids_list
Slug
ultimate-woocommerce-auction-pro
Published
2026-06-01
Title
Ultimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_manage_auctions
Slug
ultimate-wp-mail
Published
2025-04-09
Title
Ultimate WP Mail <= 1.3.9 - Open Redirect
Slug
ultimate-wp-mail
Published
2025-05-07
Title
Ultimate WP Mail < 1.3.5 - Cross-Site Request Forgery
Slug
ultimate-wp-mail
Published
2025-05-07
Title
Ultimate WP Mail < 1.3.5 - Authenticated (Contributor+) SQL Injection
Slug
ultimate-wp-mail
Published
2025-06-05
Title
Ultimate WP Mail < 1.3.6 - Missing Authorization
Slug
ultimate-wp-mail
Published
2025-07-15
Title
Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function
Slug
ultimate-wp-mail
Published
2025-09-22
Title
Ultimate WP Mail < 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting