WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-download-codes
Published
2025-01-16
Title
WP Download Codes <= 2.5.4 - Reflected Cross-Site Scripting
Slug
wp-download-manager
Published
2014-08-01
Title
WP-DownloadManager 1.60 - Script Insertion CSRF
Slug
wp-download-mirror-counter
Published
2024-10-31
Title
Download-Mirror-Counter <= 1.1 - Authenticated (Contributor+) SQL Injection
Slug
wp-downloadcounter
Published
2025-06-19
Title
WP-DownloadCounter <= 1.01 - Cross-Site Request Forgery
Slug
wp-downloadmanager
Published
2021-04-13
Title
WP-DownloadManager < 1.68.5 - Server-Side Request Forgery (SSRF)
Slug
wp-downloadmanager
Published
2021-12-28
Title
WP-DownloadManager < 1.68.7 - Reflected Cross-Site Scripting
Slug
wp-downloadmanager
Published
2022-01-12
Title
WP-DownloadManager < 1.68.7 - Admin+ Stored Cross-Site Scripting
Slug
wp-downloadmanager
Published
2024-09-27
Title
WP-DownloadManager < 1.68.9 - Reflected Cross-Site Scripting
Slug
wp-downloadmanager
Published
2025-06-10
Title
WP-DownloadManager < 1.68.11 - Authenticated (Administrator+) Arbitrary File Read
Slug
wp-downloadmanager
Published
2025-06-10
Title
WP-DownloadManager < 1.68.11 - Admin+ Arbitrary File Deletion
Slug
wp-downloadmanager
Published
2025-09-25
Title
WP-DownloadManager < 1.69 - Authenticated (Admin+) Arbitrary File Upload
Slug
wp-dpe-ges
Published
2025-05-07
Title
WP DPE-GES < 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-dream-carousel
Published
2025-01-14
Title
WP Dream Carousel <= 1.0.1b - Reflected XSS
Slug
wp-dreamworkgallery
Published
2014-08-01
Title
SWFUpload - Cross-Site Scripting (XSS)
Slug
wp-dropbox-dropins
Published
2024-10-17
Title
WP Dropbox Dropins <= 1.0 - Unauthenticated Arbitrary File Upload
Slug
wp-dropzone
Published
2025-11-17
Title
WP Dropzone < 1.1.1 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
wp-dropzone
Published
2025-12-11
Title
WP Dropzone <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'callback' Shortcode Attribute
Slug
wp-ds-blog-map
Published
2022-07-18
Title
WP DS Blog Map <= 3.1.3 - Admin+ Stored Cross-Site Scripting
Slug
wp-ds-faq
Published
2014-08-01
Title
WP DS FAQ <= 1.3.2 - ajax.php id Parameter SQL Injection
Slug
wp-ds-faq-plus
Published
2014-08-01
Title
WP DS FAQ Plus 1.0.3 - Multiple Unspecified CSRF
Slug
wp-ds-faq-plus
Published
2014-08-01
Title
WP DS FAQ Plus - Unspecified SQL Injection
Slug
wp-ds-faq-plus
Published
2020-01-24
Title
WP DS FAQ Plus < 1.4.2 - Stored Cross-Site Scripting (XSS)
Slug
wp-dtree-30
Published
2023-04-19
Title
WP-dTree <= 4.4.5 - Admin+ Stored XSS
Slug
wp-dtree-30
Published
2023-09-01
Title
WP-dTree <= 4.4.5 - Reflected XSS
Slug
wp-dtree-30
Published
2023-09-04
Title
WP-dTree <= 4.4.5 - Settings Update via CSRF