WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
code-snippets-extended
Published
2022-05-17
Title
Code Snippets Extended <= 1.4.7 - Arbitrary Snippet Deletion/Disabling via CSRF
Slug
code-snippets-extended
Published
2022-05-17
Title
Code Snippets Extended <= 1.4.7 - Stored Cross-Site Scripting via CSRF
Slug
codeablepress-simple-frontend-profile-picture-upload
Published
2025-08-14
Title
CodeablePress <= 1.0.0 - Missing Authorization
Slug
codeatoz-b2b-suite-for-woocommerce
Published
2026-10-12
Title
CodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote Disclosure
Slug
codebard-help-desk
Published
2024-12-19
Title
CodeBard Help Desk < 1.1.2 - Cross-Site Request Forgery
Slug
codebard-help-desk
Published
2025-01-14
Title
CodeBard Help Desk <= 1.1.2 - Reflected Cross-Site Scripting
Slug
codebard-help-desk
Published
2025-02-14
Title
CodeBard Help Desk <= 1.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
codebard-help-desk
Published
2026-10-09
Title
CodeBard Help Desk <= 1.1.2 - Authenticated (Subscriber+) Arbitrary File Upload
Slug
codecolorer
Published
2023-06-05
Title
CodeColorer < 0.10.1 – Admin+ Stored Cross-Site Scripting
Slug
codecolorer
Published
2025-12-30
Title
CodeColorer < 0.10.2 - Unauthenticated Stored Cross-Site Scripting
Slug
codecolorer
Published
2026-04-15
Title
CodeColorer < 0.10.2 - Unauthenticated Stored Cross-Site Scripting via 'class' attribute in 'cc' Comment Shortcode
Slug
codeconfig-accessibility
Published
2025-12-05
Title
Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters <= 1.0.2 - Authenticated (Subscriber+) Missing Authorization to Modify Accessibility Settings
Slug
codeconfig-accessibility
Published
2025-12-05
Title
Accessiy By CodeConfig Accessibility < 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation
Slug
codeflavors-vimeo-video-post-lite
Published
2023-04-14
Title
Vimeotheque < 2.2.2 - Reflected XSS
Slug
codeflavors-vimeo-video-post-lite
Published
2025-03-27
Title
Vimeotheque < 2.3.4.3 - Authenticated (Contributor+) SQL Injection
Slug
codeflavors-vimeo-video-post-lite
Published
2025-12-25
Title
Vimeotheque < 2.3.6 - Cross-Site Request Forgery
Slug
codehaveli-bitly-url-shortener
Published
2025-06-05
Title
Bitly URL Shortener < 1.5.0 - Cross-Site Request Forgery
Slug
codeless-page-builder
Published
2026-07-17
Title
Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute
Slug
codelights-shortcodes-and-widgets
Published
2022-12-21
Title
Sidebar Widgets by CodeLights <= 1.4 - Contributor+ Stored XSS
Slug
codelights-shortcodes-and-widgets
Published
2022-12-19
Title
Sidebar Widgets by CodeLights <= 1.4 - Admin+ Stored Cross Site Scripting
Slug
codemonkeys-hipaa-forms
Published
2026-03-23
Title
CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass
Slug
codemonkeys-hipaa-forms
Published
2026-10-20
Title
CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role
Slug
codepen-embed-block
Published
2025-06-19
Title
CodePen Embed Block < 1.2.1 - Admin+ Stored XSS
Slug
codepen-embedded-pen-shortcode
Published
2024-07-10
Title
CodePen Embedded Pens Shortcode < 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
codepen-embedded-pen-shortcode
Published
2024-10-24
Title
CodePen Embedded Pens Shortcode < 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting