WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wpc-smart-messages
Published
2024-10-28
Title
WPC Smart Messages for WooCommerce < 4.2.2 - Authenticated (Subscriber+) Local File Inclusion
Slug
wpc-smart-messages
Published
2024-10-28
Title
WPC Smart Messages for WooCommerce < 4.2.2 - Missing Authorization to Authenticated (Subscriber+) Message Activation/Deactivation
Slug
wpc-smart-messages
Published
2025-09-28
Title
WPC Smart Messages for WooCommerce < 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpc-smart-messages
Published
2026-04-27
Title
WPC Smart Messages for WooCommerce < 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute
Slug
wpc-smart-upsell-funnel
Published
2025-03-27
Title
WPC Smart Upsell Funnel for WooCommerce < 3.0.5 - Authenticated (Subscriber+) Arbitrary Options Update
Slug
wpcafe-pro
Published
2026-08-20
Title
WP Cafe Pro < 3.0.15 - Unauthenticated Local File Inclusion
Slug
wpcafe-pro
Published
2026-08-20
Title
WP Cafe Pro < 3.0.15 - Authenticated (Author+) Local File Inclusion
Slug
wpcafe-pro
Published
2026-08-20
Title
WP Cafe Pro < 3.0.15 - Unauthenticated Information Exposure
Slug
wpcal
Published
2024-04-22
Title
WPCal.io – Easy Meeting Scheduler < 0.9.5.9 - Cross-Site Request Forgery
Slug
wpcal
Published
2025-12-30
Title
WPCal.io < 0.9.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpcalc
Published
2021-12-06
Title
WPcalc <= 2.1 - Authenticated SQL Injection
Slug
wpcargo
Published
2022-02-21
Title
WPCargo < 6.9.0 - Unauthenticated RCE
Slug
wpcargo
Published
2022-04-25
Title
WPCargo Track & Trace < 6.9.5 - Reflected Cross Site Scripting
Slug
wpcargo
Published
2022-04-25
Title
WPCargo Track & Trace < 6.9.5 - Admin+ Stored Cross Site Scripting
Slug
wpcargo
Published
2024-09-16
Title
WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection
Slug
wpcargo
Published
2024-12-11
Title
WPCargo Track & Trace <= 8.0.6 - Subscriber+ Settings Update
Slug
wpcargo
Published
2025-03-31
Title
WPCargo Track & Trace <= 8.0.6 - Contributor+ Insecure Direct Object Reference
Slug
wpcargo
Published
2026-03-23
Title
WPCargo Track & Trace <= 8.0.6 - Missing Authorization
Slug
wpcargo
Published
2026-08-03
Title
WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number
Slug
wpcargo
Published
2026-10-28
Title
WPCargo Track & Trace <= 8.0.5 - Authenticated (Author+) PHP Object Injection
Slug
wpcas
Published
2026-01-20
Title
wpCAS <= 1.07 - Reflected Cross-Site Scripting
Slug
wpcasa
Published
2024-12-02
Title
WPCasa < 1.3.0 - Insecure Direct Object Reference
Slug
wpcasa
Published
2025-04-16
Title
WPCasa < 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wpcasa
Published
2025-09-22
Title
WPCasa < 1.4.2 - Unauthenticated Code Injection
Slug
wpcasa
Published
2025-10-16
Title
WPCasa < 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting