WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
ultimate-addons-for-gutenberg
Published
2024-04-03
Title
Spectra – WordPress Gutenberg Blocks < 2.10.4 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSS
Slug
ultimate-addons-for-gutenberg
Published
2024-04-26
Title
Spectra – WordPress Gutenberg Blocks < 2.12.7 - Contributor+ Path Traversal
Slug
ultimate-addons-for-gutenberg
Published
2024-05-22
Title
Spectra – WordPress Gutenberg Blocks < 2.12.9 - Contributor+ Stored XSS via Testimonial Block
Slug
ultimate-addons-for-gutenberg
Published
2024-05-22
Title
Spectra – WordPress Gutenberg Blocks < 2.12.9 - Contributor+ Stored XSS via Image Gallery Block
Slug
ultimate-addons-for-gutenberg
Published
2024-05-23
Title
Spectra < 2.13.1 - Author+ Stored XSS
Slug
ultimate-addons-for-gutenberg
Published
2024-07-05
Title
Spectra < 2.13.8 - Missing Authorization via generate_ai_content
Slug
ultimate-addons-for-gutenberg
Published
2024-08-07
Title
Spectra – WordPress Gutenberg Blocks < 2.15.1 - Authenticated (Contributor+) Stored Cross-site Scripting
Slug
ultimate-addons-for-gutenberg
Published
2024-12-02
Title
Spectra – WordPress Gutenberg Blocks < 2.16.3 - Contributor+ Stored XSS via Team Widget
Slug
ultimate-addons-for-gutenberg
Published
2025-03-25
Title
Spectra < 2.19.1 - Contributor+ Stored XSS
Slug
ultimate-addons-for-gutenberg
Published
2025-11-04
Title
Spectra < 2.19.15 - Contributor+ Stored XSS via Custom CSS
Slug
ultimate-ajax-login
Published
2025-09-05
Title
Ultimate AJAX Login <= 1.2.1 - Cross-Site Request Forgery
Slug
ultimate-appointment-scheduling
Published
2020-08-10
Title
Ultimate Appointment Booking & Scheduling < 1.1.10 - Authenticated Cross-Site Scripting (XSS)
Slug
ultimate-auction
Published
2014-08-01
Title
Ultimate Auction 1.0 - Cross-Site Request Forgery (CSRF)
Slug
ultimate-auction
Published
2019-12-18
Title
Ultimate Auction < 4.0.6 - Multiple CSRF & XSS
Slug
ultimate-auction
Published
2024-07-06
Title
Ultimate Auction < 4.2.6 - Cross-Site Request Forgery
Slug
ultimate-auction
Published
2024-07-26
Title
Ultimate WordPress Auction Plugin < 4.2.8 - Missing Authorization to Unauthenticated Email Creation
Slug
ultimate-auction
Published
2025-03-03
Title
Ultimate WordPress Auction Plugin < 4.3.0 - Contributor+ Arbitrary Post Deletion
Slug
ultimate-auction
Published
2025-12-12
Title
Ultimate Auction <= 4.3.2 - Missing Authorization
Slug
ultimate-auction
Published
2025-12-12
Title
Ultimate Auction <= 4.3.2 - Unauthenticated Information Exposure
Slug
ultimate-author-box-lite
Published
2021-10-13
Title
Backdoored Plugins & Themes from AccessPress Themes
Slug
ultimate-bar
Published
2025-03-24
Title
Top Bar <= 3.3 - Missing Authorization
Slug
ultimate-blocks
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
ultimate-blocks
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
ultimate-blocks
Published
2024-04-23
Title
Ultimate Blocks < 3.1.7 - Contributor+ Stored XSS
Slug
ultimate-blocks
Published
2024-06-18
Title
Ultimate Blocks – WordPress Blocks Plugin < 3.1.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via metabox