WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
apk-downloader
Published
2024-11-01
Title
APK Downloader <= 1.0.0 - Cross-Site Request Forgery to Stored Cross Site Scripting
Slug
aplazo-payment-gateway
Published
2026-01-13
Title
Aplazo Payment Gateway < 1.5.0 - Missing Authorization to Unauthenticated Order Status Manipulation
Slug
apocalypse-meow
Published
2017-12-03
Title
Apocalypse Meow 21.1.3-21.2.7 - BCrypt Authentication Bypass
Slug
apocalypse-meow
Published
2026-03-04
Title
Apocalypse Meow < 23.0.0 - Authenticated (Administrator+) SQL Injection via 'type' Parameter
Slug
apollo13-framework-extensions
Published
2023-11-03
Title
Apollo13 Framework Extensions < 1.9.1 - Contributor+ Stored XSS
Slug
apollo13-framework-extensions
Published
2023-02-24
Title
Apollo13 Framework Extensions < 1.9.0 - Missing Authorization
Slug
apollo13-framework-extensions
Published
2023-12-27
Title
Apollo13 Framework Extensions < 1.9.2 - Cross-Site Request Forgery
Slug
apollo13-framework-extensions
Published
2024-02-05
Title
Apollo13 Framework Extensions < 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
apollo13-framework-extensions
Published
2024-07-04
Title
Apollo13 Framework Extensions < 1.9.4 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
apollo13-framework-extensions
Published
2026-02-18
Title
Apollo13 Framework Extension < 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via `a13_alt_link` Parameter
Slug
apoyl-grabweixin
Published
2026-08-17
Title
[凹凸曼] 一键采集微信文章 <= 2.0.1 - Authenticated (Subscriber+) Server-Side Request Forgery
Slug
app-ads-txt
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
app-ads-txt
Published
2024-10-24
Title
Ads.txt & App-ads.txt Manager for WordPress < 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
app-builder
Published
2024-04-05
Title
App Builder < 3.8.8 - Open Redirection
Slug
app-builder
Published
2024-04-16
Title
App Builder < 3.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
app-builder
Published
2024-08-20
Title
App Builder – Create Native Android & iOS Apps On The Flight < 4.3.4 - Unauthenticated Limited SQL Injection via app-builder-search
Slug
app-builder
Published
2024-10-24
Title
App Builder – Create Native Android & iOS Apps On The Flight < 5.3.8 - Privilege Escalation and Account Takeover via Weak OTP
Slug
app-builder
Published
2025-06-19
Title
App Builder < 5.5.8 - Missing Authorization
Slug
app-builder
Published
2026-03-20
Title
App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter
Slug
app-builder
Published
2026-05-01
Title
App Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter
Slug
app-template-blocks-for-wpbakery-page-builder
Published
2025-12-11
Title
App Landing Template Blocks for WPBakery Page Builder <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
appbanners
Published
2025-06-05
Title
AppBanners <= 1.5.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
append-content
Published
2025-04-01
Title
Append Content <= 2.1.1 - Cross-Site Request Forgery to Settings Update
Slug
append-extensions-on-pages
Published
2025-09-22
Title
Append extensions on Pages <= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
append-link-on-copy
Published
2025-09-22
Title
Append Link on Copy <= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting