WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
customize-login-page
Published
2025-04-09
Title
Customize Login Page <= 1.1 - Cross-Site Request Forgery
Slug
customize-my-account-for-woocommerce
Published
2023-12-26
Title
Customize My Account for WooCommerce < 1.8.4 - Cross-Site Request Forgery via restore_my_account_tabs
Slug
customize-my-account-for-woocommerce
Published
2024-11-09
Title
SysBasics Customize My Account for WooCommerce < 2.7.30 - Reflected Cross-Site Scripting via tab Parameter
Slug
customize-my-account-for-woocommerce
Published
2024-12-21
Title
SysBasics Customize My Account for WooCommerce < 2.9.0 - Reflected Cross-Site Scripting
Slug
customize-my-account-for-woocommerce
Published
2026-06-17
Title
SysBasics Customize My Account for WooCommerce < 4.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
customize-my-account-for-woocommerce
Published
2026-06-17
Title
SysBasics Customize My Account for WooCommerce < 4.3.7 - Reflected Cross-Site Scripting via 'tab' Parameter
Slug
customize-my-account-for-woocommerce
Published
2026-07-01
Title
SysBasics Customize My Account for WooCommerce – Live My Account Customizer < 4.3.10 - Reflected Cross-Site Scripting
Slug
customize-my-account-for-woocommerce
Published
2026-07-15
Title
SysBasics Customize My Account for WooCommerce < 4.5.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'row_type' Parameter
Slug
customize-wpadmin
Published
2025-02-03
Title
Custom Links On Admin Dashboard Toolbar <= 3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
customized-login
Published
2025-04-17
Title
Login Manager – Design Login Page, View Login Activity, Limit Login Attempts <= 2.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom URL
Slug
customizely
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
customizely
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
customizer-export-import
Published
2022-10-10
Title
Customizer Export/Import < 0.9.5 - Admin+ PHP Object Injection
Slug
customizer-export-import
Published
2022-10-10
Title
Customizer Export/Import < 0.9.5 - Admin+ PHP Objection Injection
Slug
customizer-export-import
Published
2023-04-17
Title
Customizer Export/Import < 0.9.6 - Admin+ PHP Object Injection
Slug
customizer-export-import
Published
2024-09-06
Title
Customizer Export/Import < 0.9.7.1 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import
Slug
customizer-login-page
Published
2025-11-08
Title
Login Page Customizer – Customizer Login Page, Admin Page, Custom Design < 2.1.2 - Missing Authorization
Slug
cute-news-ticker
Published
2025-12-05
Title
Cute News Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute
Slug
cwd-3d-image-gallery
Published
2024-10-21
Title
CWD 3D Image Gallery <= 1.0 - Reflected Cross-Site Scripting
Slug
cwd-stealth-links
Published
2025-02-03
Title
CWD – Stealth Links <= 1.3 - Unauthenticated SQL Injection
Slug
cwicly
Published
2024-02-14
Title
Cwicly < 1.4.0.3 - Authenticated (Contributor+) Remote Code Execution
Slug
cwicly
Published
2026-08-17
Title
Cwicly <= 1.4.4 - Authenticated (Contributor+) Remote Code Execution
Slug
cws-svgicons
Published
2026-07-02
Title
CWS SVGicons <= 1.5.5 - Authenticated (Contributor+) SQL Injection
Slug
cww-companion
Published
2024-03-12
Title
CWW Companion < 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
cww-companion
Published
2025-12-15
Title
CWW Companion < 1.3.3 - Cross-Site Request Forgery