WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
youtube-video-player
Published
2025-07-03
Title
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library
Slug
youtube-widget-responsive
Published
2023-09-19
Title
Widget Responsive for Youtube < 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
youzify
Published
2021-06-28
Title
Youzify < 1.0.7 - Stored Cross-Site Scripting via Biography
Slug
youzify
Published
2022-07-11
Title
Youzify < 1.2.0 - Unauthenticated SQLi
Slug
youzify
Published
2023-01-24
Title
Youzify < 1.2.2 - Contributor+ Stored XSS
Slug
youzify
Published
2023-11-03
Title
Youzify < 1.2.3 - Insecure Direct Object Reference
Slug
youzify
Published
2024-06-19
Title
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress < 1.2.6 - Authenticated (Contributor+) SQL Injection
Slug
youzify
Published
2024-07-04
Title
Youzify < 1.2.6 - Authenticated (Contributor+) SQL Injection
Slug
youzify
Published
2024-07-24
Title
Youzify < 1.2.8 - Missing Authorization
Slug
youzify
Published
2024-10-09
Title
Youzify < 1.3.1 - Subscriber+ Arbitrary Attachment Deletion
Slug
youzify
Published
2024-10-09
Title
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress < 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via youzify_media Shortcode
Slug
youzify
Published
2025-01-24
Title
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress By KaineLabs < 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Review Deletion
Slug
youzify
Published
2025-01-24
Title
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress < 1.3.5 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
Slug
youzify
Published
2025-01-24
Title
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress < 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (save_addon_key_license)
Slug
youzify
Published
2025-12-27
Title
Youzify <= 1.3.7 - Subscriber+ Server-Side Request Forgery
Slug
youzify
Published
2026-04-17
Title
Youzify < 1.3.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkin_place_id' Parameter
Slug
youzify-moderation
Published
2024-03-25
Title
Buddypress Moderation <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting
Slug
yphplista
Published
2024-11-08
Title
yPHPlista <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
yphplista
Published
2024-11-22
Title
yPHPlista <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
yr-activity-link
Published
2024-11-08
Title
活动链接推广插件 < 1.2.4 - Contributor+ Stored XSS
Slug
yslider
Published
2025-11-10
Title
YSlider <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
yt-cookie-nonsense
Published
2024-11-08
Title
Cookie Nonsense for YT <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
yt-player
Published
2021-09-22
Title
YT Player < 1.4 - Contributor+ Stored Cross-Site Scripting
Slug
yt-player
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
yt-player
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting