WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
corona-virus-covid-19-banner
Published
2022-10-24
Title
Corona Virus (COVID-19) Banner & Live Data < 1.8.0 - CSRF
Slug
corona-virus-covid-19-banner
Published
2024-05-06
Title
Corona Virus (COVID-19) Banner & Live Data <= 1.8.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
coronavirus-covid-19-notice-message
Published
2025-02-18
Title
Coronavirus (COVID-19) Notice Message <= 1.1.2 - Admin+ Stored XSS
Slug
coronavirus-data-widgets
Published
2025-01-16
Title
Coronavirus (COVID-19) Outbreak Data Widgets <= 1.1.1 - Reflected Cross-Site Scripting
Slug
correct-prices
Published
2026-05-19
Title
Correct Prices <= 1.0 - Reflected Cross-Site Scripting via PHP_SELF Parameter
Slug
correos-express
Published
2021-11-29
Title
CorreosExpress <= 2.6.0 - Sensitive Information Disclosure
Slug
correosoficial
Published
2023-01-31
Title
Correos Oficial < 1.3.0.3 - Unauthenticated Arbitrary File Download
Slug
coru-lfmember
Published
2022-04-27
Title
Coru LFMember <= 1.0.2 - Arbitrary Game Deletion/Activation via CSRF
Slug
coru-lfmember
Published
2022-04-26
Title
Coru LFMember <= 1.0.2 - Stored Cross-Site Scripting via CSRF
Slug
corvuspay-woocommerce-integration
Published
2026-06-23
Title
CorvusPay WooCommerce Payment Gateway < 2.7.5 - Missing Authorization
Slug
corvuspay-woocommerce-integration
Published
2026-07-08
Title
CorvusPay WooCommerce Payment Gateway < 2.7.5 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter
Slug
corvuspay-woocommerce-integration
Published
2026-07-08
Title
CorvusPay WooCommerce Payment Gateway < 2.7.5 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint
Slug
corvuspay-woocommerce-integration
Published
2026-07-10
Title
CorvusPay WooCommerce Payment Gateway < 2.7.5 - Unauthenticated Stored Cross-Site Scripting via 'approval_code' Parameter
Slug
coschedule-by-todaymade
Published
2023-04-13
Title
CoSchedule < 3.3.9 - CSRF
Slug
coschedule-by-todaymade
Published
2025-09-26
Title
CoSchedule < 3.4.0 - Unauthenticated Sensitive Information Exposure
Slug
coschedule-by-todaymade
Published
2025-11-04
Title
CoSchedule < 3.4.1 - Missing Authorization
Slug
coschool
Published
2024-12-11
Title
CoSchool LMS <= 1.4.3 - Missing Authorization to Privilege Escalation
Slug
coschool
Published
2025-07-07
Title
CoSchool LMS <= 1.4.3 - Unauthenticated PHP Object Injection
Slug
coschool
Published
2025-07-14
Title
CoSchool LMS <= 1.4.3 - Authenticated (Subscriber+) SQL Injection
Slug
cosign-sso
Published
2025-12-04
Title
CoSign Single Signon <= 0.3.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Slug
cosmetsy-core
Published
2023-12-07
Title
Multiple Plugins by KlbTheme - Reflected Cross-Site Scripting
Slug
cosmic-blocks
Published
2025-02-18
Title
Cosmic Blocks (40+) Content Editor Blocks Collection <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
cosmosfarm-share-buttons
Published
2024-11-28
Title
소셜 공유 버튼 By 코스모스팜 <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
cost-calculator
Published
2026-02-25
Title
EM Cost Calculator <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting via 'customer_name'
Slug
cost-calculator-builder
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting