WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-rss-aggregator
Published
2024-02-06
Title
WP RSS Aggregator < 4.23.6 - Authenticated (Admin+) Server-Side Request Forgery via RSS Feed Source
Slug
wp-rss-aggregator
Published
2024-05-14
Title
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging < 4.23.9 - Reflected Cross-Site Scripting
Slug
wp-rss-aggregator
Published
2024-07-15
Title
WP RSS Aggregator < 4.23.12 - Missing Authorization to Authenticated (Subscriber+) Feed State Update
Slug
wp-rss-aggregator
Published
2024-10-22
Title
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging < 4.23.13 - Missing Authorization
Slug
wp-rss-by-publishers
Published
2022-12-09
Title
WP RSS By Publishers <= 0.1 - Admin+ SQLi
Slug
wp-rss-by-publishers
Published
2022-12-09
Title
WP RSS By Publishers <= 0.1 - Admin+ SQLi
Slug
wp-rss-by-publishers
Published
2022-12-09
Title
WP RSS By Publishers <= 0.1 - Admin+ SQLi
Slug
wp-rss-images
Published
2023-07-04
Title
WP RSS Images <= 1.1 - Cross-Site Request Forgery
Slug
wp-rss-multi-importer
Published
2014-09-17
Title
WP RSS Multi Importer < 3.14 - Cross Site Request Forgery (CSRF)
Slug
wp-rss-multi-importer
Published
2015-11-21
Title
WP RSS Multi Importer <= 3.15 - Blind SQL Injection & Cross-Site Scripting (XSS)
Slug
wp-rss-poster
Published
2014-08-01
Title
WP RSS Poster 1.0.0 - wp-admin/admin.php wrp-add-new Page id Parameter SQL Injection
Slug
wp-s3
Published
2023-03-20
Title
WordPress Amazon S3 Plugin < 1.6 - Reflected XSS
Slug
wp-s3-smart-upload
Published
2024-04-25
Title
SSU < 1.5.1 - Missing Authorization
Slug
wp-scheduled-posts
Published
2023-11-28
Title
SchedulePress < 5.0.5 - Contributor+ Arbitrary Post Update/Deletion
Slug
wp-scheduled-posts
Published
2024-04-22
Title
SchedulePress < 5.0.9 - Missing Authorization
Slug
wp-scheduled-posts
Published
2024-07-15
Title
SchedulePress < 5.1.4 - Unauthenticated Full Path Disclosure
Slug
wp-schema-pro
Published
2024-03-04
Title
Schema Pro < 2.7.16 - Contributor+ Custom Field Access
Slug
wp-school-calendar-lite
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-scraper
Published
2024-05-21
Title
WP Scraper < 5.8 - Missing Authorization to Arbitrary Page/Post Creation
Slug
wp-scraper
Published
2024-06-20
Title
WP Scraper < 5.8.1 - Authenticated (Subscriber+) Server-Side Request Forgery
Slug
wp-scraper
Published
2025-10-10
Title
WP Scraper < 5.8.2 - Authenticated (Administrator+) Server-Side Request Forgery
Slug
wp-scribd-list
Published
2025-01-16
Title
Wp-Scribd-List <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
wp-scrippets
Published
2021-09-09
Title
WP Scrippets <= 1.5.1 - Reflected Cross-Site Scripting
Slug
wp-scriptcase
Published
2025-09-10
Title
WP Scriptcase <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter
Slug
wp-scrive
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius