WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
audio-merchant
Published
2023-11-17
Title
Audio Merchant <= 5.0.4 - Cross-Site Request Forgery to Settings Modifcation and Stored Cross-Site Scripting
Slug
audio-player
Published
2014-08-01
Title
Audio Player - player.swf playerID Parameter XSS
Slug
audio-player-block
Published
2026-09-28
Title
Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL
Slug
audio-player-with-playlist-ultimate
Published
2023-09-03
Title
Audio Player with Playlist Ultimate < 1.3 - Contributor+ Stored XSS
Slug
audio-record
Published
2018-12-24
Title
Audio Record 1.0 - Arbitrary File Upload
Slug
audio-text
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
audio-video-download-buttons-for-youtube
Published
2022-08-01
Title
Multiple Plugins from Puvox.software - Reflected Cross-Site Scripting
Slug
audio4-html5
Published
2025-05-16
Title
Radio Player Shoutcast & Icecast WordPress Plugin < 4.4.7 - Authenticated (Contributor+) SQL Injection
Slug
audiocase
Published
2024-11-08
Title
audioCase <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
audioigniter
Published
2026-05-21
Title
AudioIgniter Music Player < 2.0.3 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter
Slug
audiomack
Published
2025-12-31
Title
Audiomack <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
audiotube
Published
2025-11-20
Title
AudioTube <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
augmented-reality
Published
2020-11-05
Title
Augmented Reality <= 1.2.0 - Unauthenticated PHP File Upload leading to RCE
Slug
aumenu
Published
2025-03-20
Title
AuMenu <= 1.1.5 - Reflected Cross-Site Scripting
Slug
auphonic-importer
Published
2025-01-16
Title
Auphonic Importer <= 1.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
aurora-heatmap
Published
2026-10-07
Title
Aurora Heatmap < 1.7.3 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter
Slug
auros-core
Published
2026-06-26
Title
Auros Core <= 5.3.1 - Unauthenticated Arbitrary Shortcode Execution
Slug
auth0
Published
2020-01-31
Title
Auth0 < 3.11.3 - Unauthenticated Reflected XSS via wle Parameter
Slug
auth0
Published
2020-04-01
Title
Login by Auth0 < 4.0.0 - Multiple Vulnerabilities
Slug
auth0
Published
2024-07-09
Title
Login by Auth0 < 4.6.1 - Reflected Cross-Site Scripting via wle
Slug
authentication-and-xmlrpc-log-writer
Published
2025-08-13
Title
Authentication and xmlrpc log writer <= 1.2.2 - Reflected Cross-Site Scripting
Slug
authentication-via-otp-using-firebase
Published
2024-12-11
Title
Firebase OTP Authentication <= 1.0.1 - Missing Authorization to Privilege Escalation
Slug
authenticator
Published
2022-12-09
Title
Authenticator < 1.3.1 - Subscriber+ Denial of Service via Feed Token Disclosure
Slug
authldap
Published
2023-09-01
Title
authLdap < 2.6.2 - Admin+ Stored XSS
Slug
authldap
Published
2023-09-01
Title
authLdap < 2.5.9 - Settings Update via CSRF