WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
adirectory
Published
2024-10-24
Title
aDirectory < 1.3.1 - Unauthenticated Arbitrary File Upload
Slug
adirectory
Published
2025-02-11
Title
aDirectory – WordPress Directory Listing Plugin < 2.3.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
Slug
adirectory
Published
2025-01-20
Title
aDirectory – WordPress Directory Listing Plugin < 1.9 - Unauthenticated PHP Object Injection
Slug
adirectory
Published
2026-01-27
Title
aDirectory < 3.0.4 - Missing Authorization
Slug
adl-team
Published
2022-07-07
Title
Team <= 1.2.6 - Contributor+ Stored Cross-Site Scripting
Slug
admail
Published
2025-04-04
Title
AdMail – Multilingual Back in-Stock Notifier for WooCommerce <= 1.7.0 - Missing Authorization
Slug
admin-and-client-message-after-order-for-woocommerce
Published
2024-04-25
Title
OrderConvo < 12.5 - Missing Authorization to Arbitrary File Upload
Slug
admin-and-client-message-after-order-for-woocommerce
Published
2025-01-15
Title
Admin and Customer Messages After Order for WooCommerce < 13.3 - Authenticated (Subscriber+) Limited File Upload to Cross-Site Scripting
Slug
admin-and-client-message-after-order-for-woocommerce
Published
2025-09-16
Title
OrderConvo <= 15.1 - Unauthenticated Arbitrary File Read
Slug
admin-and-client-message-after-order-for-woocommerce
Published
2025-11-24
Title
Admin and Customer Messages After Order for WooCommerce: OrderConvo < 15 - Missing Authorization to Unauthenticated User Impersonation in Order Messages
Slug
admin-and-client-message-after-order-for-woocommerce
Published
2025-11-24
Title
Admin and Customer Messages After Order for WooCommerce: OrderConvo < 15 - Missing Authorization to Unauthenticated Information Disclosure
Slug
admin-bar
Published
2024-04-26
Title
Admin Bar Remover < 1.0.23 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Slug
admin-bar-dashboard-control
Published
2023-10-31
Title
Admin Bar & Dashboard Control < 1.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
admin-block-country
Published
2023-02-23
Title
Admin Block Country <= 7.1.4 - Cross-Site Request Forgery (CSRF)
Slug
admin-bookmarks
Published
2025-04-24
Title
Custom Admin-Bar Favorites <= 0.1 - Reflected Cross-Site Scripting
Slug
admin-chat-box
Published
2026-05-26
Title
Firebase Support & Chat Management < 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Slug
admin-cleanup
Published
2025-01-16
Title
Admin Cleanup <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
admin-columns-for-acf-fields
Published
2026-07-17
Title
Admin Columns for ACF Fields < 0.3.3.1 - Contributor+ Stored XSS via ACF Field Value Column
Slug
admin-columns-pro
Published
2021-05-31
Title
Admin Columns Free < 4.3 & Pro < 5.5.1 - Admin+ Stored XSS in Label
Slug
admin-columns-pro
Published
2021-05-31
Title
Admin Columns Free (< 4.3.2) & Pro (< 5.5.2) - Authenticated Stored Cross-Site Scripting (XSS) in Custom Field
Slug
admin-custom-login
Published
2017-03-01
Title
Admin Custom Login < 2.4.8 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
admin-custom-login
Published
2021-07-28
Title
Admin Custom Login < 3.2.8 - CSRF to Stored XSS
Slug
admin-custom-login
Published
2026-08-15
Title
Admin Custom Login < 3.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting
Slug
admin-dashboard-rss-feed
Published
2024-07-11
Title
Admin Dashboard RSS Feed < 3.4 - Administrator+ Stored XSS
Slug
admin-font-editor
Published
2016-04-13
Title
Admin Font Editor <= 1.8 - Unauthenticated Reflected Cross-Site Scripting (XSS)