WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-downloadmanager
Published
2021-04-13
Title
WP-DownloadManager < 1.68.5 - Server-Side Request Forgery (SSRF)
Slug
wp-downloadmanager
Published
2021-12-28
Title
WP-DownloadManager < 1.68.7 - Reflected Cross-Site Scripting
Slug
wp-downloadmanager
Published
2022-01-12
Title
WP-DownloadManager < 1.68.7 - Admin+ Stored Cross-Site Scripting
Slug
wp-downloadmanager
Published
2024-09-27
Title
WP-DownloadManager < 1.68.9 - Reflected Cross-Site Scripting
Slug
wp-downloadmanager
Published
2025-06-10
Title
WP-DownloadManager < 1.68.11 - Authenticated (Administrator+) Arbitrary File Read
Slug
wp-downloadmanager
Published
2025-06-10
Title
WP-DownloadManager < 1.68.11 - Admin+ Arbitrary File Deletion
Slug
wp-downloadmanager
Published
2025-09-25
Title
WP-DownloadManager < 1.69 - Authenticated (Admin+) Arbitrary File Upload
Slug
wp-downloadmanager
Published
2026-02-17
Title
WP-DownloadManager < 1.69.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'download_path' Parameter
Slug
wp-downloadmanager
Published
2026-02-17
Title
WP-DownloadManager < 1.69.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parameter
Slug
wp-dpe-ges
Published
2025-05-07
Title
WP DPE-GES < 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-dream-carousel
Published
2025-01-14
Title
WP Dream Carousel <= 1.0.1b - Reflected XSS
Slug
wp-dreamworkgallery
Published
2014-08-01
Title
SWFUpload - Cross-Site Scripting (XSS)
Slug
wp-dropbox-dropins
Published
2024-10-17
Title
WP Dropbox Dropins <= 1.0 - Unauthenticated Arbitrary File Upload
Slug
wp-dropzone
Published
2025-11-17
Title
WP Dropzone < 1.1.1 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
wp-dropzone
Published
2025-12-11
Title
WP Dropzone <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'callback' Shortcode Attribute
Slug
wp-ds-blog-map
Published
2022-07-18
Title
WP DS Blog Map <= 3.1.3 - Admin+ Stored Cross-Site Scripting
Slug
wp-ds-faq
Published
2014-08-01
Title
WP DS FAQ <= 1.3.2 - ajax.php id Parameter SQL Injection
Slug
wp-ds-faq-plus
Published
2014-08-01
Title
WP DS FAQ Plus 1.0.3 - Multiple Unspecified CSRF
Slug
wp-ds-faq-plus
Published
2014-08-01
Title
WP DS FAQ Plus - Unspecified SQL Injection
Slug
wp-ds-faq-plus
Published
2020-01-24
Title
WP DS FAQ Plus < 1.4.2 - Stored Cross-Site Scripting (XSS)
Slug
wp-dtree-30
Published
2023-04-19
Title
WP-dTree <= 4.4.5 - Admin+ Stored XSS
Slug
wp-dtree-30
Published
2023-09-01
Title
WP-dTree <= 4.4.5 - Reflected XSS
Slug
wp-dtree-30
Published
2023-09-04
Title
WP-dTree <= 4.4.5 - Settings Update via CSRF
Slug
wp-dummy-content-generator
Published
2023-07-07
Title
WP Dummy Content Generator < 3.0.0 - Cross-Site Request Forgery
Slug
wp-dummy-content-generator
Published
2024-02-02
Title
WP Dummy Content Generator < 3.1.3 - Missing Authorization