WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wordapp-mobile-app
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wordapp-mobile-app
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wordcamp-talks
Published
2017-10-18
Title
WordCamp Talks <= 1.0.0-beta2 - Formula injection via CSV exports
Slug
wordcents
Published
2026-01-16
Title
Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 - Reflected Cross-Site Scripting
Slug
wordfence
Published
2014-08-01
Title
Wordfence 3.8.6 - lib/IPTraf.php User-Agent Header Stored XSS
Slug
wordfence
Published
2014-08-01
Title
Wordfence 3.8.1 - Password Creation Restriction Bypass
Slug
wordfence
Published
2014-08-01
Title
Wordfence 3.8.1 - wp-admin/admin.php whois Parameter Stored XSS
Slug
wordfence
Published
2014-08-01
Title
Wordfence 3.3.5 - XSS & IAA
Slug
wordfence
Published
2014-09-22
Title
Wordfence 5.2.4 - Unspecified Issue
Slug
wordfence
Published
2014-09-22
Title
Wordfence 5.2.4 - IPTraf.php URI Request Stored XSS
Slug
wordfence
Published
2014-09-22
Title
Wordfence 5.2.3 - Banned IP Functionality Bypass
Slug
wordfence
Published
2014-09-27
Title
Wordfence 5.2.3 - Multiple Vulnerabilities
Slug
wordfence
Published
2014-10-07
Title
Wordfence <= 5.2.4 - Multiple Vulnerabilities (XSS & Bypasses)
Slug
wordfence
Published
2014-12-01
Title
Wordfence 5.2.2 - XSS in Referer Header
Slug
wordfence
Published
2014-12-08
Title
Wordfence <= 5.1.4 - Cross-Site Scripting (XSS)
Slug
wordfence
Published
2018-10-02
Title
Wordfence < 7.1.14 - Username Enumeration Prevention Bypass
Slug
wordfence
Published
2022-09-07
Title
Wordfence < 7.6.1 - Admin+ Stored Cross-Site Scripting
Slug
wordlift
Published
2022-08-31
Title
Wordlift < 3.37.2 - Admin+ Stored Cross-Site Scripting
Slug
wordlift
Published
2025-01-06
Title
WordLift – AI powered SEO – Schema < 3.54.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Slug
wordlift
Published
2025-06-05
Title
WordLift <= 3.54.5 - Missing Authorization
Slug
wordlift
Published
2025-08-14
Title
WordLift < 3.54.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wordlive-livecall-addon-for-woocommerce
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wordpress-23-related-posts-plugin
Published
2014-08-01
Title
WordPress Related Posts < 2.7.2 - Cross-Site Request Forgery
Slug
wordpress-23-related-posts-plugin
Published
2021-03-19
Title
WordPress Related Posts <= 3.6.4 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
wordpress-access-control
Published
2024-02-27
Title
WordPress Access Control <= 4.0.13 - Improper Access Control to Sensitive Information Exposure via REST API