WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
yaad-sarig-payment-gateway-for-wc
Published
2024-11-19
Title
Yaad Sarig Payment Gateway For WC < 2.2.5 - Subscriber+ Log Read/Deletion
Slug
yaad-sarig-payment-gateway-for-wc
Published
2025-12-15
Title
Yaad Sarig Payment Gateway For WC <= 2.2.10 - Missing Authorization
Slug
yabp
Published
2021-09-09
Title
Yet Another bol.com Plugin <= 1.4 - Reflected Cross-Site Scripting
Slug
yacp
Published
2025-01-16
Title
Yet Another Countdown <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
yada-wiki
Published
2021-06-28
Title
Yada Wiki < 3.4.1 - Contributor+ Stored XSS
Slug
yada-wiki
Published
2025-12-30
Title
Yada Wiki < 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
yahoo-boss
Published
2025-02-02
Title
Yahoo BOSS <= 0.7 - Reflected Cross-Site Scripting
Slug
yahoo-media-player
Published
2024-11-28
Title
Yahoo! WebPlayer <= 2.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
yahoo-media-player
Published
2025-08-26
Title
Yahoo! WebPlayer <= 2.0.6 - Reflected Cross-Site Scripting
Slug
yahoo-updates-for-wordpress
Published
2014-08-01
Title
Yahoo Updates < 1.0 - XSS vulnerabilities in yupdates_application.php
Slug
yamaps
Published
2023-01-17
Title
YaMaps for WordPress Plugin < 0.6.26 - Contributor+ Stored XSS
Slug
yamaps
Published
2024-08-09
Title
YaMaps for WordPress < 0.6.30 - Contributor+ Stored XSS
Slug
yamaps
Published
2025-04-04
Title
YaMaps for WordPress <= 0.6.40 - Contributor+ Stored XSS
Slug
yamaps
Published
2025-12-08
Title
YaMaps < 0.6.40 - Contributor+ Stored XSS
Slug
yame-linkinbio
Published
2025-05-01
Title
Yame | Link In Bio <= 0.9.0 - Unauthenticated Information Exposure
Slug
yandex-money-button
Published
2021-08-09
Title
Titan Framework <= 1.12.1 - Reflected Cross-Site Scripting (XSS)
Slug
yandex-money-button
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
yandex-money-button
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
yandex-pinger
Published
2025-08-20
Title
Yandex Site search pinger <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
yandexnews-feed-by-teplitsa
Published
2023-03-14
Title
Yandex.News Feed by Teplitsa <= 1.12.5 - Admin+ Stored XSS
Slug
yanewsflash
Published
2025-07-22
Title
YANewsflash <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
yatra
Published
2023-04-19
Title
Yatra < 2.1.15 - Admin+ Stored XSS
Slug
yatri-tools
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
yatri-tools
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
yawave
Published
2025-02-24
Title
Yawave <= 2.9.1 - Unauthenticated SQL Injection