WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
wordpress-seo
Published
2017-11-15
Title
Yoast SEO < 5.8 - Authenticated Cross-Site Scripting (XSS)
Slug
wordpress-seo
Published
2018-11-20
Title
Yoast SEO <= 9.1 - Authenticated Race Condition
Slug
wordpress-seo
Published
2019-07-09
Title
Yoast SEO 1.2.0-11.5 - Admin+ Stored XSS
Slug
wordpress-seo
Published
2021-10-05
Title
Yoast SEO 16.7-17.2 - Unauthenticated Full Path Disclosure
Slug
wordpress-seo
Published
2023-11-24
Title
Yoast SEO < 21.1 - Authenticated (Seo Manager+) Stored Cross-Site Scripting
Slug
wordpress-seo
Published
2024-05-06
Title
Yoast SEO < 22.6 - Reflected Cross-Site Scripting
Slug
wordpress-seo
Published
2024-05-14
Title
Yoast SEO < 22.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wordpress-seo
Published
2026-02-05
Title
Yoast SEO < 26.9 - Contributor+ Stored XSS
Slug
wordpress-seo
Published
2026-03-21
Title
Yoast SEO < 27.2 - Contributor+ Stored XSS via 'jsonText' Block Attribute
Slug
wordpress-seo
Published
2026-05-26
Title
Yoast SEO < 26.6 - Contributor+ IDOR to Sensitive Information Exposure via post_id Parameter
Slug
wordpress-seo
Published
2026-07-24
Title
Yoast SEO < 28.1 - Author+ Stored Cross-Site Scripting via Post Slug
Slug
wordpress-seo-premium
Published
2015-04-20
Title
WordPress SEO by Yoast < 2.1 - Cross-Site Scripting (XSS)
Slug
wordpress-seo-premium
Published
2019-07-09
Title
Yoast SEO 1.2.0-11.5 - Admin+ Stored XSS
Slug
wordpress-seo-premium
Published
2025-10-02
Title
Yoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wordpress-seo-premium
Published
2026-06-04
Title
Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE
Slug
wordpress-signature
Published
2025-01-31
Title
WordPress Signature <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
wordpress-simple-paypal-shopping-cart
Published
2014-08-01
Title
Simple Paypal Shopping Cart <= 3.5 - Cross-Site Request Forgery (CSRF)
Slug
wordpress-simple-paypal-shopping-cart
Published
2022-12-27
Title
WordPress Simple Shopping Cart < 4.6.2 - Contributor+ Stored XSS via Shortcode
Slug
wordpress-simple-paypal-shopping-cart
Published
2023-03-16
Title
WP Simple Shopping Cart 4.6.3 - Unauthenticated PII Disclosure
Slug
wordpress-simple-paypal-shopping-cart
Published
2024-01-26
Title
WordPress Simple Shopping Cart < 4.7.2 - Authenticated(Administrator+) Stored Cross-Site Scripting
Slug
wordpress-simple-paypal-shopping-cart
Published
2024-12-23
Title
WordPress Simple Shopping Cart < 5.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
wordpress-simple-paypal-shopping-cart
Published
2025-04-22
Title
WordPress Simple PayPal Shopping Cart < 5.1.3 - Unauthenticated Information Exposure via file_url Parameter
Slug
wordpress-simple-paypal-shopping-cart
Published
2025-04-22
Title
WordPress Simple PayPal Shopping Cart < 5.1.3 - Unauthenticated Product Price Manipulation
Slug
wordpress-simple-paypal-shopping-cart
Published
2025-04-30
Title
WordPress Simple PayPal Shopping Cart < 5.1.4 - Insecure Direct Object Reference
Slug
wordpress-simple-paypal-shopping-cart
Published
2025-04-30
Title
WordPress Simple PayPal Shopping Cart < 5.1.4 - Insecure Direct Object Reference via 'quantity'