WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-nested-pages
Published
2026-07-27
Title
Nested Pages < 3.2.15 - Editor+ Stored XSS via Post Title
Slug
wp-news-magazine
Published
2023-02-28
Title
WP News < 1.2.0 - Arbitrary Plugin Activation via CSRF
Slug
wp-news-sliders
Published
2025-01-14
Title
WP News Sliders <= 1.0 - Missing Authorization
Slug
wp-newsletter-subscription
Published
2024-09-24
Title
WP Newsletter Subscription <= 1.1 - Unauthenticated Local File Inclusion
Slug
wp-next-post-navi
Published
2024-05-20
Title
WP Next Post Navi <= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
wp-ng-weather
Published
2026-03-20
Title
WP NG Weather <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
wp-nice-loader
Published
2024-12-19
Title
WP Nice Loader <= 0.1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
wp-no-bot-question
Published
2025-03-11
Title
WP No-Bot Question <= 0.1.7 - Cross-Site Request Forgery
Slug
wp-noexternallinks
Published
2016-07-14
Title
WP No External Links <= 3.5.15 - Cross-Site Scripting (XSS)
Slug
wp-noexternallinks
Published
2017-05-31
Title
WP No External Links <= 3.5.18 – Authenticated Cross-Site Scripting (XSS)
Slug
wp-noexternallinks
Published
2017-12-28
Title
WP No External Links 4.2.1-4.2.2 - Backdoored
Slug
wp-not-login-hide-wpnlh
Published
2023-11-14
Title
WP Not Login Hide <= 1.0 - Admin+ Stored XSS
Slug
wp-notcaptcha
Published
2025-01-16
Title
WP-NOTCAPTCHA <= 1.3.1 - Reflected Cross-Site Scripting
Slug
wp-notes-widget
Published
2025-05-16
Title
WP Notes Widget <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-notification-bell
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-notification-bell
Published
2025-09-05
Title
WP Notification Bell < 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
wp-notification-bell
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
wp-nssuser-register
Published
2024-12-11
Title
Wp NssUser Register <= 1.0.0 - Unauthenticated Privilege Escalation
Slug
wp-oauth
Published
2025-11-10
Title
WP-OAuth <= 0.4.1 - Reflected Cross-Site Scripting
Slug
wp-odoo-form-integrator
Published
2025-03-24
Title
WP Odoo Form Integrator <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
wp-offers
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-offers
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-ogp
Published
2025-03-28
Title
WP-OGP <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
wp-olivecart
Published
2023-01-13
Title
WP-OliveCart <= 1.1.3 - Admin+ Stored XSS
Slug
wp-online-store
Published
2014-08-01
Title
WP Online Store 1.3.1 - index.php slug Parameter Traversal Local File Inclusion