WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
webtoffee-cookie-consent
Published
2026-07-23
Title
WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes
Slug
webtoffee-gdpr-cookie-consent
Published
2024-07-24
Title
GDPR Cookie Consent <= 2.6.0 - Unauthenticated Stored XSS
Slug
webtoffee-gdpr-cookie-consent
Published
2024-08-25
Title
GDPR Cookie Consent <= 2.6.0 - Bulk Delete via CSRF
Slug
webtoffee-product-feed
Published
2025-06-05
Title
Product Feed for WooCommerce < 2.2.9 - Missing Authorization
Slug
webtoffee-product-feed
Published
2025-10-30
Title
Product Feed for WooCommerce < 2.3.2 - Missing Authorization
Slug
webtoffee-product-feed
Published
2026-03-05
Title
WebToffee WooCommerce Product Feeds – Google Shopping, Pinterest, TikTok Ads, & More < 2.3.4 - Authenticated (Shop manager+) PHP Object Injection
Slug
webwinkelkeur
Published
2023-07-04
Title
WebwinkelKeur < 3.25 - Cross-Site Request Forgery
Slug
wecantrack
Published
2025-05-20
Title
Affiliate Sales in Google Analytics and other tools < 2.0.1 - Open Redirect
Slug
wechat-broadcast
Published
2018-09-19
Title
Wechat Broadcast <= 1.2.0 - Local/Remote File Inclusion
Slug
wechat-reward
Published
2021-09-20
Title
Wechat Reward <= 1.7 - CSRF to Stored Cross-Site Scripting
Slug
wechat-social-login
Published
2024-09-30
Title
Wechat Social login <= 1.3.0 - Unauthenticated Arbitrary File Upload
Slug
wechat-social-login
Published
2024-09-30
Title
Wechat Social login <= 1.3.0 - Authentication Bypass
Slug
wechat-subscribers-lite
Published
2024-10-30
Title
WeChat Subscribers Lite <= 1.6.6 - Reflected Cross-Site Scripting
Slug
weddingcity-lite
Published
2026-10-09
Title
WeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion
Slug
wedesigntech-portfolio
Published
2025-12-18
Title
WeDesignTech Portfolio <= 1.0.2 - Missing Authorization
Slug
wedesigntech-ultimate-booking-addon
Published
2026-01-01
Title
WeDesignTech Ultimate Booking Addon < 1.0.4 - Missing Authorization
Slug
wedesigntech-ultimate-booking-addon
Published
2026-02-25
Title
WeDesignTech Ultimate Booking Addon < 1.0.4 - Missing Authorization
Slug
wedesigntech-ultimate-booking-addon
Published
2026-02-23
Title
WeDesignTech Ultimate Booking Addon <= 1.0.1 - Authentication Bypass
Slug
wedesigntech-ultimate-booking-addon
Published
2026-02-23
Title
WeDesignTech Ultimate Booking Addon <= 1.0.1 - Subscriber+ Authentication Bypass
Slug
wedesin-html-sitemap
Published
2025-02-18
Title
Digihood HTML Sitemap <= 3.1.1 - Reflected Cross-Site Scripting via 'channel'
Slug
wedesin-html-sitemap
Published
2025-04-02
Title
Digihood HTML Sitemap <= 3.1.1 - Reflected Cross-Site Scripting
Slug
wedevs-project-manager
Published
2020-09-16
Title
Multiple Plugins/Themes - Cross-Site Request Forgery (CSRF)
Slug
wedevs-project-manager
Published
2021-03-01
Title
Multiple Plugins - CSRF Nonce Bypasses
Slug
wedevs-project-manager
Published
2021-11-10
Title
WP Project Manager < 2.4.14 - Authenticated Stored Cross-Site Scripting
Slug
wedevs-project-manager
Published
2020-09-16
Title
WP Project Manager < 2.4.1 - Cross-Site Request Forgery