WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
blocksy-companion-pro
Published
2026-04-08
Title
Blocksy Companion Pro < 2.1.29 - Unauthenticated SQL Injection
Slug
blocksy-companion-pro
Published
2026-04-22
Title
Blocksy Companion Pro < 2.1.38 - Authenticated (Contributor+) Remote Code Execution
Slug
blocksy-companion-pro
Published
2026-06-26
Title
Blocksy Companion Pro < 2.1.47 - Unauthenticated Insecure Direct Object Reference
Slug
blocksy-companion-pro
Published
2026-06-29
Title
Blocksy Companion Pro < 2.1.47 - Unauthenticated Remote Code Execution
Slug
blocksy-companion-pro
Published
2026-07-01
Title
Blocksy Companion Pro < 2.1.47 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter
Slug
blocksy-companion-pro
Published
2026-06-26
Title
Blocksy Companion Pro < 2.1.46 - Authenticated (Contributor+) Remote Code Execution
Slug
blockwheels
Published
2025-04-01
Title
BlockWheels <= 1.0.3 - Contributor+ Stored XSS
Slug
blockypage
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
blockypage
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
blog-designer
Published
2019-05-01
Title
Blog Designer <= 1.8.10 - Unauthenticated Stored Cross-Site Scripting (XSS)
Slug
blog-designer
Published
2025-09-22
Title
Blog Designer <= 3.1.8 - Missing Authorization
Slug
blog-designer-for-elementor
Published
2025-09-10
Title
Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid <= 1.1.7 - Cross-Site Request Forgery
Slug
blog-designer-for-post-and-widget
Published
2023-01-06
Title
Blog Designer – Post and Widget < 2.4.1 - Contributor+ Stored XSS via Shortcode
Slug
blog-designer-for-post-and-widget
Published
2026-04-13
Title
Multiple Plugins by "Essential Plugin" - Backdoor
Slug
blog-designer-pack
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
blog-designer-pack
Published
2023-01-06
Title
News & Blog Designer Pack < 3.3 - Contributor+ Stored XSS via Shortcode
Slug
blog-designer-pack
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
blog-designer-pack
Published
2023-10-26
Title
News & Blog Designer Pack – WordPress Blog Plugin < 3.4.2 - Unauthenticated Remote Code Execution via Local File Inclusion
Slug
blog-designer-pack
Published
2025-04-01
Title
News & Blog Designer Pack < 4.0.1 - Unauthenticated Local File Inclusion
Slug
blog-designer-pack
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
blog-designer-pro
Published
2025-05-21
Title
Blog Designer PRO for WordPress <= 3.4.7 - Unauthenticated Local File Inclusion
Slug
blog-designer-pro
Published
2025-05-30
Title
Blog Designer PRO for WordPress <= 3.4.7 - Reflected Cross-Site Scripting
Slug
blog-designer-pro
Published
2025-08-13
Title
Blog Designer PRO <= 3.4.7 - Authenticated (Subscriber+) Local File Inclusion
Slug
blog-designer-pro
Published
2025-08-29
Title
Blog Designer PRO <= 3.4.8 - Missing Authorization
Slug
blog-filter
Published
2023-10-03
Title
Blog Filter < 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode