WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
codepen-embedded-pen-shortcode
Published
2024-07-10
Title
CodePen Embedded Pens Shortcode < 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
codepen-embedded-pen-shortcode
Published
2024-10-24
Title
CodePen Embedded Pens Shortcode < 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
codepile
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
codepile
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
codepress-admin-columns
Published
2021-05-31
Title
Admin Columns Free < 4.3 & Pro < 5.5.1 - Admin+ Stored XSS in Label
Slug
codepress-admin-columns
Published
2021-05-31
Title
Admin Columns Free (< 4.3.2) & Pro (< 5.5.2) - Authenticated Stored Cross-Site Scripting (XSS) in Custom Field
Slug
coder-elementor
Published
2025-12-10
Title
Coder for Elementor <= 1.0.13 - Missing Authorization
Slug
codescar-radio-widget
Published
2025-04-09
Title
Codescar Radio Widget <= 0.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
codesnips
Published
2024-11-08
Title
codeSnips <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
codestyling-localization
Published
2014-08-01
Title
Code Styling Localization < 1.99.20 - Cross Site Scripting
Slug
codestyling-localization
Published
2015-06-03
Title
Codestyling Localization <= 1.99.30 - Multiple CSRF
Slug
coding-blocks
Published
2025-12-11
Title
Coding Blocks <= 1.1.0 - Cross-Site Request Forgery to Settings Update
Slug
codistoconnect
Published
2025-12-03
Title
Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration - Powered by Codisto <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting
Slug
codistoconnect
Published
2026-01-15
Title
Omnichannel for WooCommerce <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting
Slug
coditor
Published
2020-09-22
Title
Coditor <= 1.1 - Arbitrary File Edition, Deletion and Internal Directory Listing in wp-content
Slug
codoc
Published
2024-07-10
Title
codoc < 0.9.52 - Reflected Cross-Site Scripting
Slug
cognito-forms
Published
2024-12-11
Title
Cognito Forms <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
Slug
coil-web-monetization
Published
2025-11-17
Title
Coil Web Monetization <= 2.0.2 - Cross-Site Request Forgery
Slug
coinbase-commerce-for-contact-form-7
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
coinpayments-payment-gateway-for-woocommerce
Published
2025-05-07
Title
CoinPayments.net Payment Gateway for WooCommerce < 1.0.18 - Unauthenticated PHP Object Injection
Slug
coins-marketcap
Published
2024-12-30
Title
Coins MarketCap < 5.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
colibri-page-builder
Published
2023-06-22
Title
Colibri Page Builder < 1.0.229 - Admin+ SQL Injection
Slug
colibri-page-builder
Published
2023-12-23
Title
Colibri Page Builder < 1.0.240 - Contributor+ Stored XSS
Slug
colibri-page-builder
Published
2023-12-19
Title
Colibri Page Builder < 1.0.248 - Contributor+ Stored XSS
Slug
colibri-page-builder
Published
2024-02-22
Title
Colibri Page Builder < 1.0.260 - Import Images, Delete Post, Save Theme Data via CSRF