WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wpcom-member
Published
2025-03-06
Title
WPCOM Member < 1.7.6 - Authentication Bypass via 'user_phone'
Slug
wpcom-member
Published
2025-03-13
Title
WPCOM Member < 1.7.7 - Unauthenticated Time-Based SQL Injection
Slug
wpcom-member
Published
2025-04-16
Title
WPCOM Member < 1.7.8 - Authenticated (Contributor+) Local File Inclusion
Slug
wpcom-member
Published
2025-10-31
Title
WPCOM Member < 1.7.15 - Authenticated (Contributor+) Local File Inclusion via Shortcode
Slug
wpcom-member
Published
2025-12-15
Title
WPCOM Member < 1.7.17 - Authentication Bypass via Weak OTP
Slug
wpcommenttwit
Published
2014-12-14
Title
WP Comment Twit <= 0.5 - Multiple CSRF
Slug
wpcomplete
Published
2023-01-27
Title
WPComplete < 2.9.5 - Reflected Cross-Site Scripting
Slug
wpcomplete
Published
2025-06-19
Title
WPComplete < 2.9.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpcomplete
Published
2025-09-22
Title
WPComplete < 2.9.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpcomplete
Published
2025-10-24
Title
WPComplete < 2.9.5.4 - Missing Authorization
Slug
wpcrm
Published
2025-06-12
Title
WPCRM - CRM for Contact form CF7 & WooCommerce <= 3.2.0 - Unauthenticated SQL Injection
Slug
wpcrm
Published
2025-06-23
Title
WPCRM - CRM for Contact form CF7 & WooCommerce <= 3.2.0 - Reflected Cross-Site Scripting
Slug
wpcs-content-scheduler
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wpcs-content-scheduler
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wpcs-wp-custom-search
Published
2024-05-06
Title
WPCS ( WordPress Custom Search ) <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
wpdash-notes
Published
2024-11-22
Title
WPDash Notes <= 1.3.5 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
Slug
wpdatatables
Published
2014-11-25
Title
wpDataTables < 1.5.4 - Unauthenticated Shell Upload
Slug
wpdatatables
Published
2014-11-25
Title
wpDataTables < 1.5.4 - Unauthenticated SQL Injection
Slug
wpdatatables
Published
2019-10-11
Title
wpDataTables < 2.0.12 - Cross-Site Scripting (XSS) & SQL Injection
Slug
wpdatatables
Published
2021-02-04
Title
wpDataTables < 3.4.1 - Unauthenticated SQL Injection
Slug
wpdatatables
Published
2021-03-16
Title
wpDataTables < 3.4.2 - Improper Access Control leading to Table Permission Takeover
Slug
wpdatatables
Published
2021-03-16
Title
wpDataTables < 3.4.2 - Improper Access Control leading to Table Data Deletion
Slug
wpdatatables
Published
2021-03-16
Title
wpDataTables < 3.4.2 - Blind SQL Injection via start Parameter
Slug
wpdatatables
Published
2021-03-16
Title
wpDataTables < 3.4.2 - Blind SQL Injection via length Parameter
Slug
wpdatatables
Published
2022-04-04
Title
wpDataTables < 2.1.28 - Admin+ Stored Cross-Site Scripting