WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-stats-manager
Published
2025-08-20
Title
WP Visitor Statistics (Real Time Traffic) < 8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-stats-manager
Published
2025-12-15
Title
Visitor Statistics (Real Time Traffic) < 8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-stats-manager
Published
2026-04-07
Title
WP Visitor Statistics (Real Time Traffic) < 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height' Shortcode Attribute
Slug
wp-stats-manager
Published
2026-10-02
Title
WP Visitor Statistics (Real Time Traffic) < 8.7.1 - Unauthenticated SQL Injection via 'fullRef' Parameter
Slug
wp-stats-manager
Published
2026-10-27
Title
WP Visitor Statistics (Real Time Traffic) < 8.9 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute
Slug
wp-stats-manager
Published
2026-10-28
Title
WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter
Slug
wp-stats-manager
Published
2026-10-28
Title
WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters
Slug
wp-sticky-side-buttons
Published
2025-04-17
Title
WP Sticky Side Buttons <= 2.1 - Cross-Site Request Forgery
Slug
wp-sticky-social
Published
2023-06-19
Title
WP Sticky Social 1.0.1 - Stored XSS via CSRF
Slug
wp-store-locator
Published
2025-07-31
Title
Store Locator < 2.2.261 - Authenticated (Contributor+) PHP Object Injection
Slug
wp-store-locator
Published
2026-04-22
Title
WP Store Locator < 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl_address' Post Meta
Slug
wp-store-locator
Published
2026-09-24
Title
WP Store Locator < 3.0.0 - Unauthenticated Denial of Service
Slug
wp-store-locator
Published
2026-10-08
Title
WP Store Locator < 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-store-locator-extenders
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-store-locator-extenders
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-storymap
Published
2025-08-14
Title
StoryMap <= 2.1 - Cross-Site Request Forgery
Slug
wp-storymap
Published
2025-09-05
Title
StoryMap <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-strava
Published
2024-11-12
Title
WP-Strava <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
wp-stripe-checkout
Published
2022-11-22
Title
WP Stripe Checkout < 1.2.2.21 - Contributor+ Stored XSS
Slug
wp-stripe-checkout
Published
2023-12-28
Title
WP Stripe Checkout < 1.2.2.38 - Sensitive Information Exposure via Debug Log
Slug
wp-stripe-checkout
Published
2024-04-16
Title
WP Stripe Checkout < 1.2.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
wp-stripe-checkout
Published
2026-10-23
Title
WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret
Slug
wp-stripe-donation
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-stripe-donation
Published
2023-02-20
Title
Accept Stripe Donation - AidWP < 3.1.6 - CSRF
Slug
wp-stripe-donation
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting