WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wp-board
Published
2021-08-22
Title
WP-Board <= 1.1 (beta) - Unauthenticated SQL Injection
Slug
wp-booking-system
Published
2017-05-16
Title
WP Booking System < 1.4 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
wp-booking-system
Published
2019-05-22
Title
WP Booking System < 1.5.2 - CSRF to Authenticated SQL Injection
Slug
wp-booking-system
Published
2021-12-10
Title
WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
wp-booking-system
Published
2023-02-02
Title
WP Booking System < 2.0.18.1 - Admin+ Stored XSS
Slug
wp-booking-system
Published
2023-12-04
Title
WP Booking System < 2.0.19.3 - Missing Authorization
Slug
wp-booking-system
Published
2024-09-13
Title
WP Booking System – Booking Calendar < 2.0.19.9 - Reflected Cross-Site Scripting
Slug
wp-booking-system
Published
2024-10-24
Title
WP Booking System < 2.0.19.11 - Missing Authorization via wpbs_refresh_calendar_editor
Slug
wp-bookmarks
Published
2025-04-01
Title
WP Bookmarks <= 1.1 - Reflected Cross-Site Scripting
Slug
wp-books-gallery
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-books-gallery
Published
2023-02-20
Title
Books Gallery < 4.4.9 - CSRF
Slug
wp-books-gallery
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-bookwidgets
Published
2025-10-14
Title
WP BookWidgets < 0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wp-bootscraper
Published
2024-11-18
Title
Bootscraper < 4.0.0 - Unauthenticated Local File Inclusion
Slug
wp-bootstrap-tabs
Published
2025-11-10
Title
WP Bootstrap Tabs <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
wp-born-babies
Published
2022-05-16
Title
WP Born Babies <= 1.0 - Contributor+ Stored Cross-Site Scripting
Slug
wp-broken-images
Published
2024-03-29
Title
Broken Images <= 0.2 - Cross-Site Request Forgery
Slug
wp-browser-update
Published
2023-04-24
Title
WP BrowserUpdate < 4.6 - Admin+ Stored XSS
Slug
wp-browser-update
Published
2023-04-24
Title
WP BrowserUpdate < 4.5 - Settings Update via CSRF
Slug
wp-buddha-free-adwords
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-buddha-free-adwords
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
wp-bugbot
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
wp-bugbot
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
wp-bulk-delete
Published
2024-09-30
Title
WP Bulk Delete < 1.3.2 - Reflected Cross-Site Scripting
Slug
wp-bulk-delete
Published
2025-08-27
Title
WP Bulk Delete < 1.3.7 - Missing Authorization