WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
underconstruction
Published
2022-05-26
Title
underConstruction < 1.20 - Construction Mode Deactivation via CSRF
Slug
underconstruction
Published
2024-03-29
Title
underConstruction < 1.22 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
ungallery
Published
2014-08-01
Title
UnGallery <= 1.5.8 - Local File Disclosure
Slug
ungallery
Published
2014-08-01
Title
UnGallery - Arbitrary Comm& Execution
Slug
ungallery
Published
2024-04-18
Title
Ungallery <= 2.2.4 - Stored XSS via CSRF
Slug
ungapped-widgets
Published
2025-11-10
Title
Ungapped Widgets <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
ungrabber
Published
2025-12-31
Title
UnGrabber <= 3.1.3 - Missing Authorization
Slug
uni-woo-custom-product-options
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
uni-woo-custom-product-options
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
uni-woo-custom-product-options-premium
Published
2025-09-22
Title
Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) < 4.9.56 - Unauthenticated Arbitrary File Upload via 'uni_cpo_upload_file'
Slug
uni-woo-custom-product-options-premium
Published
2026-02-10
Title
Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) < 4.9.61 - Missing Authorization to Unauthenticated Arbitrary Attachment and Dropbox File Deletion
Slug
uniconsent-cmp
Published
2023-10-02
Title
UniConsent Cookie Consent CMP for GDPR / CCPA < 1.4.4 - Admin+ Stored XSS
Slug
unify
Published
2025-10-02
Title
Unify < 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout Shortcode
Slug
unify
Published
2026-01-06
Title
Unify < 3.4.10 - Missing Authorization to Unauthenticated Option Deletion via 'unify_plugin_downgrade' Parameter
Slug
unilevel-mlm-plan
Published
2025-01-06
Title
Unilevel MLM Plan < 2.0.0 - Reflected Cross-Site Scripting via 'page'
Slug
uninstall
Published
2015-02-11
Title
WordPress Uninstall <= 1.2.1 - WordPress Deletion via CSRF
Slug
unique-ux
Published
2025-01-16
Title
Unique UX <= 0.9.2 - Reflected Cross-Site Scripting
Slug
unite-gallery-lite
Published
2015-07-25
Title
Unite Gallery Lite < 1.5 - CSRF & Authenticated SQL Injection
Slug
unite-gallery-lite
Published
2023-05-22
Title
Unite Gallery Lite < 1.7.60 - Admin+ Local File Inclusion
Slug
unite-gallery-lite
Published
2023-05-30
Title
Unite Gallery Lite < 1.7.62 - Admin+ Stored XSS
Slug
unite-gallery-lite
Published
2024-08-09
Title
Unite Gallery Lite <= 1.7.62 - Authenticated (Contributor+) SQL Injection
Slug
unitimetable
Published
2025-02-02
Title
UniTimetable <= 1.1 - Unauthenticated Stored Cross-Site Scripting
Slug
universal-analytics
Published
2016-02-04
Title
Universal Analytics <= 1.3.0 - Authenticated Cross-Site Scripting (XSS)
Slug
universal-analytics-injector
Published
2025-01-16
Title
Universal Analytics Injector <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
universal-email-preference-center
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting