WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wholesale-pricing-woocommerce
Published
2025-03-31
Title
Quantity Dynamic Pricing & Bulk Discounts for WooCommerce < 4.0.4 - Contributor+ Stored XSS
Slug
wholesalex
Published
2024-03-26
Title
WholesaleX < 1.3.2 - Authenticated(Subscriber+) Missing Authorization via multiple AJAX actions
Slug
wholesalex
Published
2024-03-26
Title
WholesaleX < 1.3.2 - Sensitive Information Exposure via export_users
Slug
wholesalex
Published
2024-03-29
Title
WholesaleX < 1.3.3 - Unauthenticated Privilege Escalation
Slug
wholesalex
Published
2024-03-26
Title
WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing) < 1.3.3 - Unauthenticated PHP Object Injection
Slug
whydowork-adsense
Published
2014-12-29
Title
WhyDoWork AdSense 1.2 - XSS & CSRF
Slug
wibiya
Published
2025-02-13
Title
Wibiya Toolbar <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
wibstats-statistics-for-wordpress-mu
Published
2025-01-16
Title
Wibstats <= 0.5.5 - Reflected Cross-Site Scripting
Slug
wicked-folders
Published
2022-01-03
Title
Wicked Folders < 2.8.10 - Subscriber+ SQL Injection
Slug
wicked-folders
Published
2023-02-07
Title
Wicked Folders < 2.18.17 - Subscriber+ Folder Structure Update
Slug
wicked-folders
Published
2023-02-07
Title
Wicked Folders < 2.18.17 - Folder Structure Update via CSRF
Slug
wide-banner
Published
2025-09-16
Title
Wide Banner <= 1.0.4 - Missing Authorization
Slug
widget-control-powered-by-everyblock
Published
2014-08-01
Title
Widget Control Powered By Everyblock 1.0.1 - wp-admin/admin.php idDropdown Parameter XSS Weakness
Slug
widget-countdown
Published
2025-01-24
Title
Widget Countdown < 2.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
widget-countdown
Published
2025-05-07
Title
Widget Countdown < 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
widget-detector-elementor
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
widget-extend-builtin-query
Published
2022-08-01
Title
Multiple Plugins from Puvox.software - Reflected Cross-Site Scripting
Slug
widget-for-contact-form-7
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
widget-for-eventbrite-api
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
widget-for-eventbrite-api
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
widget-for-eventbrite-api
Published
2025-05-07
Title
Display Eventbrite Events < 6.3 - Authenticated (Contributor+) Local File Inclusion
Slug
widget-google-reviews
Published
2022-11-18
Title
Plugin for Google Reviews < 2.2.3 - Subscriber+ Widget Creation
Slug
widget-google-reviews
Published
2023-03-15
Title
Plugin for Google Reviews < 2.2.4 - Subscriber+ SQLi
Slug
widget-google-reviews
Published
2024-01-12
Title
Plugin for Google Reviews < 3.2 - Contributor+ Stored Cross-Site Scripting via shortcode
Slug
widget-google-reviews
Published
2025-12-05
Title
Rich Shortcodes for Google Reviews < 6.8.1 - Unauthenticated Stored XSS via Google Review