WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
custom-twitter-feeds
Published
2024-09-17
Title
Custom Twitter Feeds < 2.2.3 - Admin+ Stored XSS
Slug
custom-twitter-feeds
Published
2024-10-21
Title
Custom Twitter Feeds (Tweets Widget) < 2.2.4 - Cross-Site Request Forgery
Slug
custom-twitter-feeds
Published
2025-03-19
Title
Custom Twitter Feeds < 2.3.0 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function
Slug
custom-twitter-feeds
Published
2026-05-12
Title
Custom Twitter Feeds < 2.5.5 - Unauthenticated Stored XSS via Cached Tweet Text
Slug
custom-url-shorter
Published
2024-11-08
Title
Custom URL Shortener <= 0.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
custom-url-to-featured-image
Published
2025-12-31
Title
Add Featured Image Custom Link <= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
custom-user-css
Published
2024-01-03
Title
Custom User CSS <= 0.2 - Settings Update via CSRF
Slug
custom-user-guide
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
custom-user-guide
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
custom-users-order
Published
2025-01-16
Title
Custom Users Order <= 4.2 - Reflected Cross-Site Scripting
Slug
custom-welcome-guide
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
custom-welcome-guide
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
custom-widget-classes
Published
2025-01-16
Title
Custom Widget Classes <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
custom-widget-creator
Published
2025-01-16
Title
Custom Widget Creator <= 1.0.5 - Reflected Cross-Site Scripting
Slug
custom-word-cloud
Published
2025-08-01
Title
Custom Word Cloud <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via angle Parameter
Slug
custom-wp-rest-api
Published
2024-12-11
Title
Ultimate Endpoints With Rest Api <= 2.2.2 - Reflected Cross-Site Scripting
Slug
customcomment
Published
2025-08-17
Title
Custom Comment <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
customcomment
Published
2025-08-20
Title
Custom Comment <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
customer-area
Published
2017-11-22
Title
Customer Area < 7.4.3 - XSS
Slug
customer-area
Published
2023-01-17
Title
WP Customer Area < 8.1.4 - Unauthorised Actions via CSRF
Slug
customer-area
Published
2024-01-10
Title
WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak
Slug
customer-area
Published
2024-01-10
Title
WP Customer Area < 8.2.1 - Subscriber+ Account Address Update
Slug
customer-area
Published
2024-01-23
Title
WP Customer Area < 8.2.3 - Reflected Cross-Site Scripting
Slug
customer-area
Published
2025-01-06
Title
WP Customer Area < 8.2.5 - Bulk Delete via CSRF
Slug
customer-area
Published
2025-01-06
Title
WP Customer Area < 8.2.5 - Event Log Deletion via CSRF