WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
captivatesync-trade
Published
2025-05-05
Title
Captivate Sync < 3.2.2 - Unauthenticated PHP Object Injection
Slug
captivatesync-trade
Published
2025-12-21
Title
Captivate Sync < 3.3.0 - Authenticated (Administrator+) SQL Injection
Slug
capturly-optimize-your-website
Published
2025-04-21
Title
Capturly < 2.0.2 - Unauthenticated Local File Inclusion
Slug
car
Published
2020-04-05
Title
Car Rental System <= 1.3 - Unauthenticated Stored Cross-Site Scripting (XSS)
Slug
car-demon
Published
2014-08-01
Title
Car Demon 1.0.1 - /wp-admin/edit.php Multiple Parameter XSS
Slug
car-demon
Published
2014-08-01
Title
Car Demon 1.0.1 - /wp-admin/post.php Multiple Parameter XSS
Slug
car-demon
Published
2025-01-14
Title
Car Demon <= 1.8.1 - Reflected Cross-Site Scripting
Slug
car-park-booking-system-for-wordpress
Published
2025-04-22
Title
Car Park Booking System for WordPress <= 2.6 - Missing Authorization
Slug
car-park-booking-system-for-wordpress
Published
2026-06-09
Title
Car Park Booking System <= 1.0 - Unauthenticated SQL Injection
Slug
car-rental
Published
2017-04-12
Title
Multiple BestWebSoft Plugins - Authenticated Cross-Site Scripting (XSS)
Slug
car-rental
Published
2022-11-09
Title
Car Rental by BestWebSoft <= 1.1.2 - Admin+ Stored XSS
Slug
car-rental-manager
Published
2025-12-24
Title
Car Rental Manager < 1.2.0 - Missing Authorization
Slug
car-rental-manager
Published
2026-08-07
Title
Car Rental Manager – Online Vehicle Booking System < 1.3.8 - Missing Authorization
Slug
car-rental-manager
Published
2026-08-12
Title
Car Rental Manager < 1.4.0 - Authenticated (Editor+) PHP Object Injection
Slug
car-rental-system
Published
2015-08-26
Title
Car Rental System <= 3.0 - SQL Injection
Slug
card-elements-for-elementor
Published
2024-08-07
Title
Card Elements for Elementor < 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
card-elements-for-elementor
Published
2025-02-26
Title
Card Elements for Elementor < 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Profile Card Widget
Slug
card-elements-for-wpbakery
Published
2025-09-22
Title
Card Elements for WPBakery < 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
card-flip-image-slideshow
Published
2025-07-04
Title
Card flip image slideshow <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
card-games
Published
2021-07-05
Title
Flash Games <= 2.2 - CSRF Bypass
Slug
card-oracle
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
card-oracle
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
cardealer
Published
2022-11-21
Title
Car Dealer < 3.05 - Subscriber+ Arbitrary Plugin Installation
Slug
cardealer
Published
2024-04-25
Title
Car Dealer < 4.16 - Admin+ Content Injection
Slug
cardealer
Published
2024-12-11
Title
Car Dealer < 4.48 - Missing Authorization