WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
cms-commander-client
Published
2026-03-20
Title
CMS Commander <= 2.288 - Custom+ SQL Injection via 'or_blogname' Parameter
Slug
cms-fuer-motorrad-werkstaetten
Published
2026-04-16
Title
CMS für Motorrad Werkstätten <= 1.0.0 - Cross-Site Request Forgery
Slug
cms-fuer-motorrad-werkstaetten
Published
2026-04-20
Title
Plugin: CMS für Motorrad Werkstätten <= 1.0.0 - Authenticated (Subscriber+) SQL Injection via 'arttype' Parameter
Slug
cms-pack-cache
Published
2014-08-01
Title
Cms Pack 1.3 - Shell Upload
Slug
cms-press
Published
2023-03-13
Title
CMS Press <= 0.2.3 - Admin+ Stored XSS
Slug
cms-tree-page-view
Published
2014-08-01
Title
CMS Tree Page View 1.2.4 - Page Creation CSRF
Slug
cms-tree-page-view
Published
2014-08-01
Title
CMS Tree Page View 0.8.8 - XSS
Slug
cms-tree-page-view
Published
2015-04-21
Title
CMS Tree Page View 1.2.31 - Multiple Parameter XSS
Slug
cms-tree-page-view
Published
2023-04-20
Title
CMS Tree Page View < 1.6.8 - Reflected XSS
Slug
cmsmasters-content-composer
Published
2024-10-08
Title
CMSMasters Content Composer < 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
cmsmasters-content-composer
Published
2025-07-01
Title
CMSMasters Content Composer < 2.5.7 - Unauthenticated Local File Inclusion
Slug
cmsmasters-content-composer
Published
2026-02-02
Title
CMSMasters Content Composer < 1.4.6 - Authenticated (Contributor+) Local File Inclusion
Slug
cmsmasters-content-composer
Published
2025-12-14
Title
CMSMasters Content Composer < 2.5.9 - Missing Authorization
Slug
cmsmasters-elementor-addon
Published
2024-12-02
Title
CMSMasters Elementor Addon < 1.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Slug
cmyee-momentopress
Published
2023-11-06
Title
MomentoPress for Momento360 < 1.0.2 - Contributor+ Stored XSS
Slug
cnvrse
Published
2026-02-11
Title
Cnvrse < 026.02.10.20 - Unauthenticated Insecure Direct Object Reference
Slug
cnzz51la-for-wordpress
Published
2025-01-16
Title
CNZZ&51LA for WordPress <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
co-authors-plus
Published
2022-06-02
Title
Co-Authors-Plus 3.5/3.5.1 - Guest Authors Email Address Disclosure
Slug
co-marquage-service-public
Published
2024-03-25
Title
Co-marquage service-public.fr < 0.5.73 - Reflected Cross-Site Scripting via search_term
Slug
co-marquage-service-public
Published
2024-03-25
Title
Co-marquage service-public.fr < 0.5.72 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Slug
co-marquage-service-public
Published
2024-11-20
Title
Co-marquage service-public.fr < 0.5.77 - Reflected Cross-Site Scripting via add_query_arg Parameter
Slug
co-marquage-service-public
Published
2025-12-31
Title
Co-marquage service-public.fr <= 0.5.77 - Cross-Site Request Forgery
Slug
co2ok-for-woocommerce
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
co2ok-for-woocommerce
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
co2ok-for-woocommerce
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting