WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wibstats-statistics-for-wordpress-mu
Published
2025-01-16
Title
Wibstats <= 0.5.5 - Reflected Cross-Site Scripting
Slug
wicked-folders
Published
2022-01-03
Title
Wicked Folders < 2.8.10 - Subscriber+ SQL Injection
Slug
wicked-folders
Published
2023-02-07
Title
Wicked Folders < 2.18.17 - Subscriber+ Folder Structure Update
Slug
wicked-folders
Published
2023-02-07
Title
Wicked Folders < 2.18.17 - Folder Structure Update via CSRF
Slug
wicked-folders
Published
2026-03-14
Title
Wicked Folders < 4.1.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion
Slug
wide-banner
Published
2025-09-16
Title
Wide Banner <= 1.0.4 - Missing Authorization
Slug
widget-context
Published
2026-05-21
Title
Widget Context < 1.4.0 - Cross-Site Request Forgery to Settings Update via 'wl' Parameter
Slug
widget-control-powered-by-everyblock
Published
2014-08-01
Title
Widget Control Powered By Everyblock 1.0.1 - wp-admin/admin.php idDropdown Parameter XSS Weakness
Slug
widget-countdown
Published
2025-01-24
Title
Widget Countdown < 2.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
widget-countdown
Published
2025-05-07
Title
Widget Countdown < 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
widget-countdown
Published
2026-01-09
Title
Countdown Timer - Widget Countdown < 2.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
widget-detector-elementor
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
widget-extend-builtin-query
Published
2022-08-01
Title
Multiple Plugins from Puvox.software - Reflected Cross-Site Scripting
Slug
widget-for-contact-form-7
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
widget-for-eventbrite-api
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
widget-for-eventbrite-api
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
widget-for-eventbrite-api
Published
2025-05-07
Title
Display Eventbrite Events < 6.3 - Authenticated (Contributor+) Local File Inclusion
Slug
widget-for-eventbrite-api
Published
2026-02-18
Title
Display Eventbrite Events < 6.5.7 - Missing Authorization
Slug
widget-for-eventbrite-api
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
widget-google-reviews
Published
2022-11-18
Title
Plugin for Google Reviews < 2.2.3 - Subscriber+ Widget Creation
Slug
widget-google-reviews
Published
2023-03-15
Title
Plugin for Google Reviews < 2.2.4 - Subscriber+ SQLi
Slug
widget-google-reviews
Published
2024-01-12
Title
Plugin for Google Reviews < 3.2 - Contributor+ Stored Cross-Site Scripting via shortcode
Slug
widget-google-reviews
Published
2025-12-05
Title
Rich Shortcodes for Google Reviews < 6.8.1 - Unauthenticated Stored XSS via Google Review
Slug
widget-google-reviews
Published
2026-02-15
Title
Rich Showcase for Google Reviews < 6.9.4.4 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
widget-logic
Published
2019-06-28
Title
Widget Logic < 5.10.2 - CSRF to RCE