WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-photo-album-plus
Published
2026-10-16
Title
WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter
Slug
wp-photo-album-plus
Published
2026-10-27
Title
WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
Slug
wp-photo-effects
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-photo-effects
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
wp-photo-effects
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-photo-effects
Published
2025-10-02
Title
WP Photo Effects <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
wp-photo-sphere
Published
2025-01-16
Title
WP Photo Sphere <= 3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-photo-text-slider-50
Published
2023-10-30
Title
Wp photo text slider 50 < 8.1 - Authenticated (Subscriber+) SQL Injection via Shortcode
Slug
wp-photo-text-slider-50
Published
2024-12-13
Title
Wp photo text slider 50 <= 8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-photonav
Published
2025-06-25
Title
WP-PhotoNav <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photonav Shortcode
Slug
wp-php-widget
Published
2014-08-01
Title
WP PHP Widget 1.0.2 - Full Path Disclosure
Slug
wp-phpmyadmin-extension
Published
2022-08-01
Title
Multiple Plugins from Puvox.software - Reflected Cross-Site Scripting
Slug
wp-phpmyadmin-extension
Published
2022-08-01
Title
WP phpMyAdmin < 5.2.0.4 - Admin+ Stored Cross-Site Scripting
Slug
wp-picasa-image
Published
2014-06-12
Title
WP Picasa Image <= 1.0 - XSS
Slug
wp-pinterest-automatic
Published
2021-09-06
Title
Pinterest Automatic < 4.14.4 - Unauthenticated Arbitrary Options Update
Slug
wp-pinterest-automatic
Published
2025-05-16
Title
Pinterest Automatic Pin <= 4.19.0 - Missing Authorization
Slug
wp-pinterest-automatic
Published
2025-07-16
Title
Pinterest Automatic Pin < 4.19.0 - Authenticated (Subscriber+) SQL Injection
Slug
wp-pipes
Published
2022-12-20
Title
WP Pipes < 1.4.0 - Admin+ SQLi
Slug
wp-pipes
Published
2023-10-03
Title
WP Pipes < 1.4.1 - CSRF
Slug
wp-pipes
Published
2024-12-10
Title
WP Pipes < 1.4.2 - Reflected Cross-Site Scripting via x1 Parameter
Slug
wp-pipes
Published
2025-05-07
Title
WP Pipes <= 1.4.3 - Authenticated (Administrator+) Server-Side Request Forgery
Slug
wp-pipes
Published
2025-05-30
Title
WP Pipes < 1.4.3 - Unauthenticated Arbitrary File Deletion
Slug
wp-pipes
Published
2025-07-08
Title
WP Pipes <= 1.4.3 - Unauthenticated SQL Injection
Slug
wp-pipes
Published
2025-07-22
Title
WP Pipes <= 1.4.3 - Unauthenticated Local File Inclusion
Slug
wp-pipes
Published
2025-08-14
Title
WP Pipes <= 1.4.3 - Reflected Cross-Site Scripting