WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wpp-customization
Published
2024-12-12
Title
Admin Customization <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
wppageflip
Published
2012-07-10
Title
A Page Flip Book 2.3 - index.php pageflipbook_language Parameter Traversal Local File Inclusion
Slug
wppdf
Published
2024-03-29
Title
Responsive flipbook <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wppedia
Published
2025-05-20
Title
Glossary by WPPedia <= 1.3.0 - Authenticated (Administrator+) PHP Object Injection
Slug
wpperformancetester
Published
2023-12-06
Title
WPPerformanceTester <= 2.0.0 - Cross-Site Request Forgery
Slug
wppizza
Published
2015-05-14
Title
Multiple Plugins - jQuery prettyPhoto DOM Cross-Site Scripting (XSS)
Slug
wppizza
Published
2023-08-18
Title
WPPizza < 3.17.2 - Reflected XSS
Slug
wppizza
Published
2023-10-31
Title
WPPizza < 3.18.3 - Reflected XSS
Slug
wppizza
Published
2024-04-25
Title
WPPizza < 3.18.11 - Missing Authorization
Slug
wppizza
Published
2024-06-18
Title
WPPizza – A Restaurant Plugin < 3.18.14 - Reflected Cross-Site Scripting
Slug
wppizza
Published
2025-02-23
Title
WPPizza < 3.19.5 - Reflected Cross-Site Scripting
Slug
wppizza
Published
2025-08-22
Title
WPPizza < 3.19.8.1 - Missing Authorization
Slug
wppopupmagic
Published
2026-01-08
Title
WP Popup Magic <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute
Slug
wppricing-builder-lite-responsive-pricing-table-builder
Published
2024-10-14
Title
wpPricing Builder <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wppygments
Published
2014-08-01
Title
wppygments <= 0.3.2 - XSS in ZeroClipboard
Slug
wpqa
Published
2022-04-21
Title
WPQA < 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fields
Slug
wpqa
Published
2022-04-21
Title
WPQA < 5.2 - Subscriber+ Private Message Disclosure via IDOR
Slug
wpqa
Published
2022-04-21
Title
WPQA < 5.2 - Subscriber+ Arbitrary Profile Picture Deletion via IDOR
Slug
wpqa
Published
2022-05-16
Title
WPQA < 5.5 - Unauthenticated Private Message Disclosure
Slug
wpqa
Published
2022-05-10
Title
WPQA < 5.4 - Reflected Cross-Site Scripting
Slug
wpqa
Published
2022-08-01
Title
WPQA < 5.7 - Subscriber+ Private Message Disclosure via IDOR
Slug
wpqa
Published
2022-10-25
Title
WPQA < 5.9 - Follow/Unfollow via CSRF
Slug
wpqa
Published
2022-12-13
Title
WPQA < 5.9.3 - Missing validation lead to functionality abuse
Slug
wpqa
Published
2024-06-12
Title
WPQA < 6.1.1 - Arbitrary Category and Tag Follow/Unfollow via CSRF
Slug
wpqa
Published
2024-06-12
Title
WPQA < 6.1.1 - Contributor+ Stored XSS