WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wpcasa
Published
2025-10-16
Title
WPCasa < 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpcasa-mail-alert
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wpcb
Published
2014-08-01
Title
wpcb 2.4.8 - facture.php id Parameter Reflected XSS
Slug
wpcf7-redirect
Published
2021-04-20
Title
Redirection for Contact Form 7 < 2.3.4 - Authenticated Arbitrary Plugin Installation
Slug
wpcf7-redirect
Published
2021-04-20
Title
Redirection for Contact Form 7 < 2.3.4 - Unprotected AJAX Actions
Slug
wpcf7-redirect
Published
2021-04-20
Title
Redirection for Contact Form 7 < 2.3.4 - Unauthenticated Arbitrary Nonce Generation
Slug
wpcf7-redirect
Published
2021-04-20
Title
Redirection for Contact Form 7 < 2.3.4 - Authenticated PHP Object Injection
Slug
wpcf7-redirect
Published
2021-04-20
Title
Redirection for Contact Form 7 < 2.3.4 - Authenticated Arbitrary Post Deletion
Slug
wpcf7-redirect
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wpcf7-redirect
Published
2022-03-07
Title
Redirection for Contact Form 7 < 2.5.0 - Reflected Cross-Site Scripting
Slug
wpcf7-redirect
Published
2022-09-29
Title
Redirection for Contact Form 7 < 2.6.0 - Unauthenticated Options Update to Stored XSS
Slug
wpcf7-redirect
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wpcf7-redirect
Published
2023-10-03
Title
Redirection for Contact Form 7 < 3.0.0 - Missing Authorization
Slug
wpcf7-redirect
Published
2025-08-19
Title
Redirection for Contact Form 7 < 3.2.5 - Unauthenticated PHP Object Injection
Slug
wpcf7-redirect
Published
2025-08-19
Title
Redirection for Contact Form 7 < 3.2.5 - Unauthenticated Arbitrary File Deletion
Slug
wpcf7-redirect
Published
2025-08-19
Title
Redirection for Contact Form 7 < 3.2.5 - Unauthenticated PHP Object Injection via PHAR Deserialization
Slug
wpcf7-redirect
Published
2025-10-17
Title
Redirection for Contact Form 7 < 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode
Slug
wpcf7-redirect
Published
2025-12-20
Title
Redirection for Contact Form 7 < 3.2.8 - Unauthenticated Arbitrary File Copy
Slug
wpcf7-stop-words
Published
2025-11-03
Title
Social Media WPCF7 Stop Words <= 1.1.3 - Cross-Site Request Forgery to Settings Update
Slug
wpcleaner
Published
2025-04-01
Title
WP Cleaner <= 1.1.5 - Reflected Cross-Site Scripting
Slug
wpcode-content-ratio
Published
2025-07-07
Title
WPCode Content Ratio <= 2.0 - Reflected Cross-Site Scripting
Slug
wpcodefactory-helper
Published
2023-06-30
Title
WPFactory Helper < 1.5.3 - Reflected Cross-Site Scripting
Slug
wpcodefactory-helper
Published
2024-09-12
Title
WPFactory Helper < 1.7.1 - Reflected Cross-Site Scripting
Slug
wpcom-member
Published
2024-09-06
Title
WPCOM Member < 1.5.3 - Unauthenticated Privilege Escalation via User Meta
Slug
wpcom-member
Published
2024-09-30
Title
WPCOM Member < 1.5.4.1 - Reflected Cross-Site Scripting