WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wpcf7-redirect
Published
2025-08-19
Title
Redirection for Contact Form 7 < 3.2.5 - Unauthenticated PHP Object Injection via PHAR Deserialization
Slug
wpcf7-redirect
Published
2025-10-17
Title
Redirection for Contact Form 7 < 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode
Slug
wpcf7-redirect
Published
2025-12-20
Title
Redirection for Contact Form 7 < 3.2.8 - Unauthenticated Arbitrary File Copy
Slug
wpcf7-stop-words
Published
2025-11-03
Title
Social Media WPCF7 Stop Words <= 1.1.3 - Cross-Site Request Forgery to Settings Update
Slug
wpcleaner
Published
2025-04-01
Title
WP Cleaner <= 1.1.5 - Reflected Cross-Site Scripting
Slug
wpcode-content-ratio
Published
2025-07-07
Title
WPCode Content Ratio <= 2.0 - Reflected Cross-Site Scripting
Slug
wpcodefactory-helper
Published
2023-06-30
Title
WPFactory Helper < 1.5.3 - Reflected Cross-Site Scripting
Slug
wpcodefactory-helper
Published
2024-09-12
Title
WPFactory Helper < 1.7.1 - Reflected Cross-Site Scripting
Slug
wpcom-member
Published
2024-09-06
Title
WPCOM Member < 1.5.3 - Unauthenticated Privilege Escalation via User Meta
Slug
wpcom-member
Published
2024-09-30
Title
WPCOM Member < 1.5.4.1 - Reflected Cross-Site Scripting
Slug
wpcom-member
Published
2025-03-06
Title
WPCOM Member < 1.7.6 - Authentication Bypass via 'user_phone'
Slug
wpcom-member
Published
2025-03-13
Title
WPCOM Member < 1.7.7 - Unauthenticated Time-Based SQL Injection
Slug
wpcom-member
Published
2025-04-16
Title
WPCOM Member < 1.7.8 - Authenticated (Contributor+) Local File Inclusion
Slug
wpcom-member
Published
2025-10-31
Title
WPCOM Member < 1.7.15 - Authenticated (Contributor+) Local File Inclusion via Shortcode
Slug
wpcom-member
Published
2025-12-15
Title
WPCOM Member < 1.7.17 - Authentication Bypass via Weak OTP
Slug
wpcommenttwit
Published
2014-12-14
Title
WP Comment Twit <= 0.5 - Multiple CSRF
Slug
wpcomplete
Published
2023-01-27
Title
WPComplete < 2.9.5 - Reflected Cross-Site Scripting
Slug
wpcomplete
Published
2025-06-19
Title
WPComplete < 2.9.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpcomplete
Published
2025-09-22
Title
WPComplete < 2.9.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpcomplete
Published
2025-10-24
Title
WPComplete < 2.9.5.4 - Missing Authorization
Slug
wpcrm
Published
2025-06-12
Title
WPCRM - CRM for Contact form CF7 & WooCommerce <= 3.2.0 - Unauthenticated SQL Injection
Slug
wpcrm
Published
2025-06-23
Title
WPCRM - CRM for Contact form CF7 & WooCommerce <= 3.2.0 - Reflected Cross-Site Scripting
Slug
wpcs-content-scheduler
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wpcs-content-scheduler
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wpcs-wp-custom-search
Published
2024-05-06
Title
WPCS ( WordPress Custom Search ) <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting