WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
webmention
Published
2026-04-01
Title
Webmention < 5.7.0 - Unauthenticated Blind Server-Side Request Forgery
Slug
webmention
Published
2026-06-30
Title
Webmention < 5.8.1 - Unauthenticated Stored Cross-Site Scripting via MF2 'photo'/'url' Author Properties
Slug
webmention
Published
2026-10-30
Title
Webmention < 5.10.2 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag
Slug
webo-facto-connector
Published
2024-09-17
Title
Webo-facto < 1.41 - Unauthenticated Privilege Escalation
Slug
webo-mcp
Published
2026-09-29
Title
WEBO MCP < 3.0.22 - Authenticated (Author+) Arbitrary File Deletion
Slug
webp-conversion
Published
2026-01-26
Title
WebP Conversion <= 2.2 - Missing Authorization
Slug
webp-converter-for-media
Published
2019-06-27
Title
WebP Converter for Media <= 1.0.2 - Cross-Site Request Forgery (CSRF)
Slug
webp-converter-for-media
Published
2021-12-27
Title
WebP Converter for Media < 4.0.3 - Unauthenticated Open redirect
Slug
webp-converter-for-media
Published
2025-12-16
Title
Converter for Media < 6.4.0 - Subscriber+ Optimized Image Deletion via regenerate-attachment REST Endpoint
Slug
webp-converter-for-media
Published
2026-02-11
Title
Converter for Media – Optimize images < 6.5.2 - Unauthenticated SSRF
Slug
webp-express
Published
2019-06-16
Title
WebP Express <= 0.14.10 - Multiple Issues
Slug
webp-express
Published
2019-06-26
Title
WebP Express < 0.14.8 - Authenticated Stored XSS
Slug
webp-express
Published
2025-12-03
Title
WebP Express < 0.25.11 - Unauthenticated Information Exposure
Slug
webp-express
Published
2026-10-20
Title
WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser
Slug
webp-svg-support
Published
2024-06-05
Title
WebP & SVG Support <= 1.4.0 - Author+ Stored XSS via SVG
Slug
webparex
Published
2025-02-21
Title
Shipmozo Courier Tracking <= 1.0 - Reflected Cross-Site Scripting
Slug
webpurifytextreplace
Published
2026-02-03
Title
WebPurify Profanity Filter < 4.0.3 - Missing Authorization to Unauthenticated Plugin Settings Change via webpurify_save_options
Slug
webpushr-web-push-notifications
Published
2023-11-06
Title
Webpushr < 4.35.0 - Unauthenticated Stored XSS
Slug
webpushr-web-push-notifications
Published
2023-10-19
Title
Webpushr < 4.35.0 - LFI via CSRF
Slug
webpushr-web-push-notifications
Published
2024-05-03
Title
Webpushr < 4.36.0 - Reflected Cross-Site Scripting
Slug
webpushr-web-push-notifications
Published
2026-01-25
Title
Webpushr < 4.39.0 - Unauthenticated Information Exposure
Slug
webpushr-web-push-notifications
Published
2026-07-22
Title
Web Push Notifications <= 4.39.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'webpushr_notification_title' Post Meta Parameter
Slug
webriti-companion
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
webriti-custom-login-page
Published
2024-11-01
Title
Webriti Custom Login <= 0.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
Slug
webriti-smtp-mail
Published
2022-05-18
Title
Webriti SMTP Mail <= 1.0 - Arbitrary Settings Update via CSRF