WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
availability-calendar
Published
2023-11-24
Title
Availability Calendar <= 1.2.6 - Cross-Site Request Forgery via add_availability_calendar_create_admin_page()
Slug
avalex
Published
2023-02-02
Title
Avalex < 3.0.4 - Admin+ Stored XSS
Slug
avalex
Published
2023-11-14
Title
avalex – Automatisch sichere Rechtstexte < 3.0.9 - Missing Authorization
Slug
avartan-slider-lite
Published
2023-08-11
Title
Avartan Slider Lite <= 1.5.3 - Reflected XSS
Slug
avatar
Published
2025-04-17
Title
Avatar <= 0.1.4 - Authenticated (Subscriber+) Arbitrary File Deletion
Slug
avatar
Published
2025-04-17
Title
Avatar <= 0.1.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Slug
avchat-3
Published
2014-08-01
Title
AVChat Video Chat 1.4.1 - index_popup.php Multiple Parameters Reflected XSS
Slug
avchat-3
Published
2024-10-18
Title
AVChat Video Chat <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
avcp
Published
2023-11-07
Title
ANAC XML Bandi di Gara <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Slug
avcp
Published
2023-11-07
Title
ANAC XML Bandi di Gara <= 7.5 - Cross-Site Request Forgery via settings.php
Slug
avcp
Published
2023-11-07
Title
ANAC XML Bandi di Gara <= 7.5 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
avcp
Published
2025-11-24
Title
ANAC XML Bandi di Gara < 7.7.1 - Reflected Cross-Site Scripting
Slug
avectra-netforum-single-sign-on
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
avectra-netforum-single-sign-on
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
avenirsoft-directdownload
Published
2015-08-09
Title
Avenir-soft Direct Download <= 1.0 - Cross-Site Scripting (XSS) & CSRF
Slug
aviary-image-editor-add-on-for-gravity-forms
Published
2015-06-09
Title
Aviary Image Editor Add-on For Gravity Forms <= 3.0beta - Unauthenticated File Upload
Slug
aviation-weather-from-noaa
Published
2025-06-30
Title
Aviation Weather from NOAA <= 0.7.2 - Authenticated (Subscriber+) Arbitrary File Deletion
Slug
avif-support
Published
2024-09-30
Title
AVIF & SVG Uploader < 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
avif-support
Published
2024-09-16
Title
AVIF & SVG Uploader <= 1.1.0 - Author+ Stored XSS via SVG Uplaod
Slug
avirato-calendar
Published
2023-04-17
Title
Avirato hotels online booking engine <= 5.0.5 - Subscriber+ SQLi
Slug
avishi-wp-paypal-payment-button
Published
2025-07-18
Title
Avishi WP PayPal Payment Button <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
aw-woocommerce-kode-pembayaran
Published
2025-01-16
Title
AW WooCommerce Kode Pembayaran <= 1.1.4 - Reflected Cross-Site Scripting
Slug
awa-plugins
Published
2026-02-25
Title
Awa Plugins <= 1.4.4 - Reflected Cross-Site Scripting
Slug
awcode-toolkit
Published
2025-05-19
Title
AWcode Toolkit < 1.0.19 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
aweber-web-form-widget
Published
2023-11-13
Title
AWeber < 7.3.10 - Missing Authorization via AJAX actions