WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
confirm-user-registration
Published
2025-04-24
Title
Confirm User Registration <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
conformer-elementor
Published
2025-12-31
Title
Conformer for Elementor < 1.0.8 - Missing Authorization
Slug
connatix-video-embed
Published
2024-12-13
Title
Connatix Video Embed <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
connect-contact-form-7-to-constant-contact-v3
Published
2024-12-11
Title
Connect Contact Form 7 to Constant Contact < 1.5 - Reflected Cross-Site Scripting
Slug
connect-daily-web-calendar
Published
2022-12-20
Title
WordPress Events Calendar Plugin < 1.4.5 - Multiple Reflected XSS
Slug
connect-daily-web-calendar
Published
2025-04-09
Title
WordPress Events Calendar Plugin – connectDaily < 1.5.5 - Stored XSS via CSRF
Slug
connect-daily-web-calendar
Published
2025-09-05
Title
WordPress Events Calendar Plugin – connectDaily <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
connected-sermons
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
connected-sermons
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
connections
Published
2014-08-01
Title
Connections Business Directory <= 0.7.9.3 - Pagination URL H&ling XSS
Slug
connections
Published
2014-08-01
Title
Connections <= 0.7.1.5 - Unspecified Security
Slug
connections
Published
2016-02-02
Title
Connections <= 8.5.8 - Reflected Cross-Site Scripting (XSS)
Slug
connections
Published
2021-09-28
Title
Connections Business Directory < 10.4.3 - Admin+ Stored Cross-Site Scripting
Slug
connections
Published
2020-05-29
Title
Connections Business Directory < 9.7 - Admin+ CSV Injection
Slug
connections
Published
2023-06-26
Title
Connections Business Directory < 10.4.37 - Contributor+ Stored XSS
Slug
connections
Published
2025-01-24
Title
Connections Business Directory <= 10.4.66 - Authenticated (Admin+) Arbitrary Directory Deletion
Slug
connector-civicrm-mcrestface
Published
2025-03-31
Title
Connector to CiviCRM with CiviMcRestFace < 1.0.11 - Missing Authorization
Slug
connector-civicrm-mcrestface
Published
2025-04-09
Title
Connector to CiviCRM with CiviMcRestFace < 1.0.9 - Reflected Cross-Site Scripting
Slug
consensu-io
Published
2023-11-23
Title
Consensu.io < 1.0.4 - Unauthenticated Settings Update
Slug
consensus-embed
Published
2026-03-06
Title
Consensus Embed <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute
Slug
constant-contact-api
Published
2025-09-01
Title
Constant Contact for WordPress <= 4.1.1 - Unauthenticated PHP Object Injection
Slug
constant-contact-forms
Published
2020-09-06
Title
Constant Contact Forms < 1.8.8 - Multiple Authenticated Stored XSS
Slug
constant-contact-forms
Published
2024-01-03
Title
Constant Contact Forms < 2.4.3 - Information Disclosure via Log Files
Slug
constant-contact-forms-by-mailmunch
Published
2023-10-16
Title
Constant Contact Forms by MailMunch < 2.0.11 - Arbitrary Settings Update via CSRF
Slug
constant-contact-forms-by-mailmunch
Published
2024-01-10
Title
Constant Contact Forms by MailMunch < 2.1.0 - Contributor+ Stored XSS