WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
unlimited-elements-for-elementor
Published
2025-08-27
Title
Unlimited Elements For Elementor < 1.5.149 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
unlimited-elements-for-elementor
Published
2025-11-26
Title
Unlimited Elements For Elementor and Unlimited Elements For Elementor (Premium) < 2.0.1 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
Slug
unlimited-elements-for-elementor-premium
Published
2025-11-26
Title
Unlimited Elements For Elementor and Unlimited Elements For Elementor (Premium) < 2.0.1 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
Slug
unlimited-page-sidebars
Published
2025-01-31
Title
Unlimited Page Sidebars < 0.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
unlimited-popups
Published
2016-04-21
Title
Unlimited Pop-Ups <= 1.4.3 - Cross-Site Scripting (XSS)
Slug
unlimited-popups
Published
2021-10-07
Title
Unlimited PopUps <= 4.5.3 - Author+ SQL Injection
Slug
unlimited-theme-addons
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
unlimited-theme-addons
Published
2025-01-10
Title
Unlimited Theme Addon For Elementor and WooCommerce < 1.2.3 - Authenticated (Contributor+) Post Disclosure
Slug
unlimited-timeline
Published
2025-04-15
Title
Unlimited Timeline < 1.6.1 - Missing Authorization
Slug
unlock-addons-for-elementor
Published
2024-12-05
Title
Unlock Addons for Elementor <= 2.2.3 - Contributor+ Stored XSS
Slug
unsafe-mimetypes
Published
2025-04-24
Title
Unsafe Mimetypes <= 0.1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
unusedcss
Published
2023-03-10
Title
RapidLoad Power-Up for Autoptimize < 1.7.2 - Multiple Subscriber+ Unauthorised AJAX Calls
Slug
unusedcss
Published
2023-01-20
Title
RapidLoad Power-Up for Autoptimize < 1.6.36 - Subscriber+ SQLi
Slug
unusedcss
Published
2023-03-10
Title
RapidLoad Power-Up for Autoptimize < 1.7.2 - Unauthorised AJAX Calls
Slug
unusedcss
Published
2024-04-05
Title
RapidLoad Power-Up for Autoptimize < 2.2.12 - Unauthenticated Server-Side Request Forgery
Slug
unusedcss
Published
2024-12-10
Title
RapidLoad – Optimize Web Vitals Automatically < 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification and SQL Injection
Slug
unusedcss
Published
2025-01-31
Title
RapidLoad – Optimize Web Vitals Automatically < 2.4.5 - Missing Authorization to Authenticated (Subscriber+) Limited Setting Reset
Slug
unusedcss
Published
2025-02-03
Title
RapidLoad < 2.4.5 - Missing Authorization
Slug
unyson
Published
2018-09-15
Title
Unyson <= 2.7.18 - Force the download/unpack of Fonts Files
Slug
unyson
Published
2022-07-04
Title
Unyson < 2.7.27 - Reflected Cross-Site Scripting
Slug
unyson
Published
2023-09-29
Title
Unyson <= 2.7.28 - Missing Authorization
Slug
unyson
Published
2024-05-09
Title
Unyson < 2.7.31 - Cross-Site Request Forgery
Slug
up-down-image-slideshow-gallery
Published
2023-10-30
Title
Up down image slideshow gallery < 12.1 - Authenticated (Subscriber+) SQL Injection via Shortcode
Slug
upc-ean-barcode-generator
Published
2025-04-01
Title
UPC/EAN/GTIN Code Generator < 2.0.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Slug
upc-ean-barcode-generator
Published
2025-08-25
Title
UPC/EAN/GTIN Code Generator < 2.0.3 - Authenticated (Subscriber+) Arbitrary File Deletion