WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
auto-tag-links
Published
2025-02-24
Title
Auto Tag Links <= 1.0.13 - Cross-Site Request Forgery
Slug
auto-terms-of-service-and-privacy-policy
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
auto-thickbox
Published
2025-07-03
Title
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library
Slug
auto-thickbox-plus
Published
2015-11-26
Title
Auto ThickBox Plus <= 1.9 - Reflected Cross-Site Scripting (XSS)
Slug
auto-thumbnailer
Published
2025-12-04
Title
Auto Thumbnailer <= 1.0 - Authenticated (Contributor+) Arbitrary File Upload
Slug
auto-translate
Published
2024-05-21
Title
Automatic Translator with Google Translate <= 1.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Font
Slug
auto-upload-images
Published
2022-10-24
Title
Auto Upload Images < 3.3.1 - CSRF
Slug
auto-upload-images
Published
2022-10-24
Title
Auto Upload Images < 3.3.1 - Admin+ Stored Cross-Site Scripting
Slug
auto-upload-images
Published
2025-06-19
Title
Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery
Slug
auto-x-line
Published
2026-02-13
Title
Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call
Slug
auto-youtube-importer
Published
2023-02-03
Title
Auto YouTube Importer <= 1.0.3 - Settings Update via CSRF
Slug
autocatset
Published
2025-09-10
Title
AutoCatSet <= 2.1.4 - Cross-Site Request Forgery
Slug
autocomplete-address-and-location-picker-for-woocommerce
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
autocomplete-address-and-location-picker-for-woocommerce
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
autocomplete-location-field-contact-form-7
Published
2023-11-21
Title
Autocomplete Location field Contact Form 7 < 3.0 - Admin+ Store Cross-Site Scripting
Slug
autocomplete-location-field-contact-form-7-pro
Published
2023-11-21
Title
Autocomplete Location field Contact Form 7 < 3.0 - Admin+ Store Cross-Site Scripting
Slug
autocompleter
Published
2025-01-03
Title
Autocompleter <= 1.3.5.2 - Cross-Site Request Forgery
Slug
autogen-headers-menu
Published
2026-01-08
Title
Autogen Headers Menu <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'head_class' Shortcode Parameter
Slug
autolinks
Published
2022-03-28
Title
Autolinks <= 1.0.1 - Stored Cross-Site Scripting via CSRF
Slug
autolisticle-automatically-update-numbered-list-articles
Published
2024-11-22
Title
AutoListicle: Automatically Update Numbered List Articles < 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
automail
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
automail
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
automate-hub-free-by-sperse-io
Published
2025-01-06
Title
Automate Hub Free by Sperse.IO <= 1.7.0 - Reflected Cross-Site Scripting
Slug
automate-hub-free-by-sperse-io
Published
2025-01-23
Title
Automate Hub Free by Sperse.IO <= 1.7.0 - Cross-Site Request Forgery to Activation Status Update
Slug
automated-editor
Published
2023-10-13
Title
Automated Editor <= 1.3 - Arbitrary Settings Update via CSRF