WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-programmmanager
Published
2025-02-16
Title
WP-PManager <= 1.2 - Category Deletion via CSRF
Slug
wp-programmmanager
Published
2025-02-16
Title
WP-PManager <= 1.2 - Admin+ SQL Injection
Slug
wp-projects-portfolio
Published
2025-01-14
Title
WP Projects Portfolio with Client Testimonials <= 3.0 - Reflected XSS
Slug
wp-projects-portfolio
Published
2025-01-14
Title
WP Projects Portfolio with Client Testimonials <= 3.0 - Stored XSS via CSRF
Slug
wp-promoter
Published
2026-05-26
Title
WP Promoter <= 1.3 - Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Action
Slug
wp-promoter
Published
2026-05-26
Title
WP Promoter <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup_width' Parameter
Slug
wp-propagator
Published
2024-10-25
Title
Plugin Propagator <= 0.1 - Unauthenticated Arbitrary File Upload
Slug
wp-property
Published
2014-08-01
Title
WP Property < 1.38.4 - Non-administrative User XMLI Remote Information Disclosure
Slug
wp-property
Published
2014-08-01
Title
WP Property <= 1.35.0 - Arbitrary File Upload
Slug
wp-proposals
Published
2025-04-01
Title
WP Proposals <= 2.3 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
wp-proposals
Published
2025-09-22
Title
WP Proposals <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-ptviewer
Published
2025-01-16
Title
WP PT-Viewer <= 2.0.2 - Reflected Cross-Site Scripting
Slug
wp-publication-archive
Published
2025-09-05
Title
WP Publication Archive <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-publications
Published
2021-09-09
Title
wp-publications - Local File Inclusion
Slug
wp-publications
Published
2024-12-06
Title
WP Publications <= 1.2 - Admin+ Stored XSS
Slug
wp-push-notification-firebase
Published
2025-07-03
Title
WP Firebase Push Notification <= 1.2.0 - Cross-Site Request Forgery to Broadcast Notification
Slug
wp-query-console
Published
2024-10-25
Title
WP Query Console <= 1.0 - Unauthenticated Remote Code Execution
Slug
wp-query-creator
Published
2025-01-18
Title
WP Query Creator <= 1.0 - Reflected Cross-Site Scripting
Slug
wp-quick-contact-us
Published
2026-02-13
Title
WP Quick Contact Us <= 1.0 - Cross-Site Request Forgery to Settings Update
Slug
wp-quick-front-end-editor
Published
2021-01-12
Title
WP Quick FrontEnd Editor <= 5.5 - Authenticated Content Injection
Slug
wp-quick-front-end-editor
Published
2021-01-12
Title
WP Quick FrontEnd Editor <= 5.5 - Authenticated Settings Change leading to Stored XSS
Slug
wp-quick-post-duplicator
Published
2026-01-08
Title
WP Quick Post Duplicator < 2.2 - Missing Authorization
Slug
wp-quick-setup
Published
2024-11-15
Title
WP Quick Setup <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin/Theme Installation
Slug
wp-quick-shop
Published
2024-12-11
Title
WP Quick Shop < 1.3.2 - Reflected Cross-Site Scripting
Slug
wp-quicklatex
Published
2024-06-22
Title
WP QuickLaTeX < 3.8.7 - Admin+ Stored XSS in Background Color field