WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-marketing-automations
Published
2026-04-22
Title
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce < 3.8.0 - Missing Authorization
Slug
wp-marketing-automations
Published
2026-10-26
Title
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce < 3.8.6 - Cross-Site Request Forgery
Slug
wp-marketing-automations
Published
2026-10-26
Title
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce < 3.8.6 - Unauthenticated SQL Injection
Slug
wp-marketing-automations
Published
2026-10-30
Title
FunnelKit Automations < 3.8.6 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter
Slug
wp-marketing-automations
Published
2026-10-30
Title
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce < 3.8.6.2 - Unauthenticated PHP Object Injection
Slug
wp-marketplace
Published
2014-08-01
Title
WP Marketplace 1.1.0 - Shell Upload
Slug
wp-masonry-infinite-scroll
Published
2025-06-25
Title
WP Masonry & Infinite Scroll < 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-masquerade
Published
2024-04-25
Title
WP Masquerade <= 1.1.0 - Subscriber+ Account Takeover
Slug
wp-mathjax-plus
Published
2024-11-28
Title
WP MathJax <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-matrix-gallery
Published
2014-08-01
Title
SWFUpload - Cross-Site Scripting (XSS)
Slug
wp-maximum-upload-file-size
Published
2024-11-22
Title
Wp Maximum Upload File Size < 1.1.4 - Authenticated (Author+) Full Path Disclosure
Slug
wp-media-categories
Published
2025-09-26
Title
WP Media Categories < 2.2.0 - Cross-Site Request Forgery
Slug
wp-media-category-management
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-media-category-management
Published
2024-04-22
Title
WP Media Category Management < 2.3.0 - Reflected Cross-Site Scripting
Slug
wp-media-category-management
Published
2025-02-18
Title
WP Media Category Management 2.0 - 2.3.3 - Cross-Site Request Forgery to Settings Update
Slug
wp-media-cleaner
Published
2015-02-26
Title
WP Media Cleaner <= 2.2.6 - Cross-Site Scripting (XSS)
Slug
wp-media-file-type-manager
Published
2025-06-05
Title
WP Media File Type Manager <= 2.3.1 - Settings Update via CSRF
Slug
wp-media-folder
Published
2024-02-12
Title
WP Media folder < 5.7.3 - Missing Authorization to Authenticated(Subscriber+) Plugin settings change
Slug
wp-media-folder
Published
2024-02-15
Title
WP Media folder < 5.7.3 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
wp-media-folder
Published
2024-02-12
Title
WP Media folder < 5.7.3 - Missing Authorization to Authenticated(Subscriber+) Title Modification
Slug
wp-media-folder
Published
2026-10-04
Title
WP Media folder <= 6.2.2 - Unauthenticated Stored Cross-Site Scripting
Slug
wp-media-folder-addon
Published
2026-06-04
Title
Media folder Addon < 4.0.2 - Unauthenticated Arbitrary File Download
Slug
wp-media-folder-addon
Published
2026-07-08
Title
Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download
Slug
wp-media-folders
Published
2026-10-28
Title
WP Media folders <= 1.1.10 - Authenticated (Contributor+) PHP Object Injection
Slug
wp-media-library-categories
Published
2023-01-20
Title
Media Library Categories < 2.0.0 - Admin+ Stored XSS