WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
bug-library
Published
2025-01-24
Title
Bug Library < 2.1.5 - Authenticated (Contributor+) SQL Injection
Slug
bugsnag
Published
2025-09-05
Title
Error Monitoring by Bugsnag < 1.6.4 - Cross-Site Request Forgery
Slug
build-app-online
Published
2022-12-06
Title
Build App Online < 1.0.19 - Unauthenticated SQL Injection
Slug
build-app-online
Published
2023-12-27
Title
Build App Online < 1.0.21 - Subscriber+ Privilege Escalation
Slug
build-app-online
Published
2023-12-27
Title
Build App Online < 1.0.22 - Unauthenticated Account Takeover via Weak Password Reset Mechanism
Slug
build-app-online
Published
2024-11-28
Title
Build App Online <= 1.0.23 - Cross-Site Request Forgery
Slug
build-app-online
Published
2025-01-06
Title
Build App Online <= 1.0.23 - Unauthenticated Local File Inclusion
Slug
build-app-online
Published
2025-04-09
Title
Build App Online <= 1.0.23 - Unauthenticated Local File Inclusion
Slug
build-app-online
Published
2025-08-14
Title
Build App Online <= 1.0.23 - Cross-Site Request Forgery
Slug
build-private-store-for-woocommerce
Published
2025-01-14
Title
Build Private Store For Woocommerce < 1.1 - Cross-Site Request Forgery
Slug
build-private-store-for-woocommerce
Published
2025-01-24
Title
Build Private Store For Woocommerce < 1.1 - Missing Authorization
Slug
builder-shortcode-extras
Published
2025-02-06
Title
Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time <= 1.0.0 - Authenticated (Contributor+) Post Disclosure
Slug
builder-style-manager
Published
2015-04-20
Title
Multiple iThemes plugins, themes and add-ons - XSS via add_query_arg() and remove_query_arg()
Slug
builderall-cheetah-for-wp
Published
2024-03-29
Title
Builderall Builder for WordPress < 2.0.2 - Unauthenticated Server-Side Request Forgery
Slug
builderall-cheetah-for-wp
Published
2025-10-23
Title
Builderall Builder for WordPress <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
builderall-cheetah-for-wp
Published
2026-02-25
Title
Builderall for WordPress <= 3.0.1 - Authenticated (Contributor+) Remote Code Execution
Slug
builderpress
Published
2026-03-12
Title
BuilderPress <= 2.0.1 - Unauthenticated Local File Inclusion
Slug
buk-appointments
Published
2024-12-13
Title
Buk for WordPress < 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
bukazu-search-widget
Published
2025-12-11
Title
BUKAZU Search widget < 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode' Shortcode Attribute
Slug
bukza
Published
2024-12-13
Title
Bukza < 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
bulgarisation-for-woocommerce
Published
2024-03-12
Title
Bulgarisation for WooCommerce < 3.0.15 - Cross-Site Request Forgery
Slug
bulgarisation-for-woocommerce
Published
2024-03-12
Title
Bulgarisation for WooCommerce < 3.0.15 - Missing Authorization
Slug
bulk-add-to-cart-xforwc
Published
2021-09-20
Title
Multiple WooCommerce Add-Ons - Low Priv Arbitrary Blog Options Update/Access/Deletion & Plugin's Settings Update/Export/Import
Slug
bulk-attachment-download
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
bulk-attachment-download
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting