WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-counter-up
Published
2024-05-07
Title
Counter Up – Animated Number Counter & Milestone Showcase < 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-counter-up
Published
2024-11-26
Title
Counter Up – Animated Number Counter & Milestone Showcase < 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-coupons-and-deals
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-coupons-and-deals
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-coupons-and-deals
Published
2025-12-11
Title
Coupons and Deals < 3.2.5 - Missing Authorization
Slug
wp-coupons-and-deals
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
wp-course-manager
Published
2024-11-01
Title
WP Course Manager <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
wp-courses
Published
2020-09-28
Title
WP Courses < 2.0.29 - Broken Access Controls leading to Courses Content Disclosure
Slug
wp-courses
Published
2021-08-16
Title
WP Courses LMS < 2.0.44 - Reflected Cross-Site Scripting
Slug
wp-courses
Published
2021-08-16
Title
WP Courses LMS < 2.0.44 - Authenticated Stored XSS via Video Embed Code
Slug
wp-courses
Published
2023-11-14
Title
WP Courses LMS < 3.2.4 - Missing Authorization
Slug
wp-courses
Published
2023-11-14
Title
WP Courses LMS < 3.2.4 - Cross-Site Request Forgery
Slug
wp-courses
Published
2023-11-14
Title
WP Courses LMS < 3.2.4 - Subscriber+ Arbitrary Options Update
Slug
wp-courses
Published
2024-12-11
Title
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses < 3.2.22 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Update
Slug
wp-courses
Published
2026-03-23
Title
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses < 3.2.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
wp-courses
Published
2026-08-24
Title
WP Courses LMS < 3.2.30 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' Parameter
Slug
wp-crm
Published
2022-05-18
Title
WP-CRM <= 1.2.1 - CSV Injection
Slug
wp-crm-system
Published
2024-03-28
Title
WP-CRM System < 3.2.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
wp-crm-system
Published
2024-12-14
Title
WP-CRM System < 3.4.0 - Unauthenticated Duplicate Contact Settings Update
Slug
wp-crm-system
Published
2025-05-07
Title
WP-CRM System < 3.4.6 - Authenticated (Administrator+) PHP Object Injection
Slug
wp-crm-system
Published
2025-06-05
Title
WP-CRM System < 3.4.3 - Missing Authorization
Slug
wp-crm-system
Published
2025-12-08
Title
WP-CRM System <= 3.4.5 - Missing Authorization
Slug
wp-crm-system
Published
2026-01-13
Title
WP-CRM System – Manage Clients and Projects < 3.4.6 - Missing Authorization to Authenticated (Subscriber+) CRM Data Exposure and Task Modification
Slug
wp-crm-system
Published
2025-11-04
Title
WP-CRM System < 3.4.6 - Missing Authorization
Slug
wp-cron-dashboard
Published
2014-08-01
Title
WP Cron DashBoard <= 1.1.5 - Reflected Cross-Site Scripting (XSS)