WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
backwpup
Published
2023-12-18
Title
BackWPup < 4.0.4 - Unauthenticated Backup Download
Slug
backwpup
Published
2024-08-16
Title
BackWPup < 4.0.2 - Admin+ Directory Traversal
Slug
backwpup
Published
2025-10-24
Title
BackWPup < 5.5.1 - Missing Authorization to Sensitive Information Exposure
Slug
backwpup
Published
2026-02-18
Title
BackWPup < 5.6.3 - BackWPup Helper+ Privilege Escalation via Arbitrary Options Update
Slug
backwpup
Published
2026-04-13
Title
BackWPup < 5.6.7 - Admin+ Local File Inclusion via 'block_name' Parameter
Slug
backwpup
Published
2026-07-27
Title
BackWPup < 5.7.5 - Unauthenticated Stored Cross-Site Scripting
Slug
backwpup
Published
2026-09-09
Title
BackWPup 5.2.2 - 5.7.4 - BackWPup Jobs Checker+ Database Backup Exfiltration via Missing Authorization on Job REST Routes
Slug
backwpup
Published
2026-10-06
Title
BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX
Slug
backwpup
Published
2026-10-06
Title
BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback
Slug
backwpup
Published
2026-10-06
Title
BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php
Slug
bacola-core
Published
2023-12-07
Title
Multiple Plugins by KlbTheme - Reflected Cross-Site Scripting
Slug
bacon-ipsum
Published
2025-06-05
Title
Bacon Ipsum <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
bad-behavior
Published
2012-05-11
Title
Bad Behavior < 2.2.5 - Cross-Site Scripting (XSS)
Slug
badgearoo
Published
2024-12-07
Title
Badgearoo <= 1.0.14 - Reflected XSS
Slug
badgearoo
Published
2024-12-07
Title
Badgearoo <= 1.0.14 - Admin+ Stored XSS
Slug
badgeos
Published
2022-04-13
Title
BadgeOS < 3.7.1 - Unauthenticated SQLi
Slug
badgeos
Published
2022-08-23
Title
BadgeOS < 3.7.1.3 - Subscriber+ SQLi
Slug
badgeos
Published
2023-04-18
Title
BadgeOS <= 3.7.1.6 - CSRF
Slug
badgeos
Published
2023-07-05
Title
BadgeOS <= 3.7.1.6 - Contributor+ Stored Cross-Site Scripting
Slug
badgeos
Published
2023-07-05
Title
BadgeOS <= 3.7.1.6 - Subscriber+ IDOR
Slug
badgeos
Published
2023-07-05
Title
BadgeOS <= 3.7.1.6 - Missing Authorization in delete_badgeos_log_entries
Slug
badgeos
Published
2023-11-07
Title
BadgeOS <= 3.7.1.6 - Missing Authorization
Slug
badr-naver-syndication
Published
2025-02-13
Title
Naver Syndication V2 <= 0.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
baggage-freight
Published
2018-12-24
Title
Baggage Freight Shipping Australia 0.1.0 - Unauthenticated Arbitrary File Upload
Slug
baidu-tongji-generator
Published
2023-05-18
Title
Baidu Tongji generator <= 1.0.2 - Admin+ Stored XSS