WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
x-addons-elementor
Published
2025-05-16
Title
X Addons for Elementor < 1.0.17 - Contributor+ Stored XSS
Slug
x-addons-elementor
Published
2025-10-02
Title
X Addons for Elementor < 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Video ID Field
Slug
x-forms-express
Published
2014-10-21
Title
NEX-Forms Lite <= 2.1.0 - Stored Cross-Site Scripting (XSS)
Slug
xagio-seo
Published
2025-01-24
Title
Xagio SEO < 7.0.0.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
xagio-seo
Published
2025-06-10
Title
Xagio SEO < 7.1.0.17 - Unauthenticated Stored Cross-Site Scripting via 'HTTP_REFERER'
Slug
xagio-seo
Published
2025-08-27
Title
Xagio SEO < 7.1.0.6 - Unauthenticated Sensitive Information Exposure via Unprotected Back-Up Files
Slug
xagio-seo
Published
2025-12-04
Title
Xagio SEO <= 7.1.0.29 - Missing Authorization
Slug
xagio-seo
Published
2026-01-05
Title
Xagio SEO < 7.1.0.31 - Authenticated (Subscriber+) Server-Side Request Forgery
Slug
xatkit-chatbot-connector
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
xavins-list-subpages
Published
2025-05-06
Title
Xavin's List Subpages <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
xavins-review-ratings
Published
2025-05-02
Title
Xavin's Review Ratings <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
xc-woo-google-cloud-print
Published
2025-04-23
Title
Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) <= 4.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Information Disclosure
Slug
xcloner-backup-and-restore
Published
2014-08-01
Title
XCloner - Backup and Restore < 3.1.1 - Multiple Actions CSRF
Slug
xcloner-backup-and-restore
Published
2014-10-17
Title
XCloner - Backup and Restore < 3.1.2 - Multiple Vulnerabilities (RCE & LFI)
Slug
xcloner-backup-and-restore
Published
2015-05-10
Title
XCloner - Backup and Restore 3.1.2 - XSS & Command Execution
Slug
xcloner-backup-and-restore
Published
2016-12-31
Title
XCloner - Backup and Restore < 3.1.5 - Authenticated Path Traversal
Slug
xcloner-backup-and-restore
Published
2020-09-22
Title
XCloner Backup and Restore < 4.2.153 - Cross-Site Request Forgery
Slug
xcloner-backup-and-restore
Published
2020-09-22
Title
XCloner Backup and Restore 4.2.1 - 4.2.12 - Unprotected AJAX Action
Slug
xcloner-backup-and-restore
Published
2022-06-06
Title
XCloner < 4.3.6 - Plugin Settings Reset
Slug
xcloner-backup-and-restore
Published
2024-07-15
Title
XCloner < 4.7.4 - Unauthenticated Full Path Disclosure
Slug
xcloner-backup-and-restore
Published
2025-12-04
Title
Backup, Restore and Migrate your sites with XCloner < 4.8.3 - Cross-Site Request Forgery in Xcloner_Remote_Storage:save()
Slug
xelion-webchat
Published
2025-04-16
Title
Xelion Webchat < 9.2.0 - Authenticated (Subscriber+) Privilege Escalation
Slug
xelion-webchat
Published
2025-04-23
Title
Xelion Webchat < 9.2.0 - Authenticated (Subscriber+) Arbitrary Options Update
Slug
xen-carousel
Published
2014-08-01
Title
XEN Carousel < 0.12.2 - XSS vulnerabilities in xencarousel-admin.js.php via path or ajaxpath parameter
Slug
xerte-online
Published
2014-08-01
Title
Xerte Online <= 0.35 - File Upload