WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
cozy-addons
Published
2026-07-28
Title
Cozy Blocks < 2.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute
Slug
cozy-addons
Published
2026-07-31
Title
Cozy Blocks < 2.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute
Slug
cozy-addons
Published
2026-08-24
Title
Cozy Blocks < 2.2.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute
Slug
cozy-addons
Published
2026-08-31
Title
Cozy Blocks < 2.2.18 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter
Slug
cp-blocks
Published
2022-02-02
Title
CP Blocks < 1.0.15 - Admin+ Stored Cross-Site Scripting
Slug
cp-blocks
Published
2023-10-06
Title
CP Blocks < 1.0.21 - CSRF
Slug
cp-contact-form-with-paypal
Published
2015-07-11
Title
CP Contact Form with Paypal <= 1.1.5 - Multiple Vulnerabilities
Slug
cp-contact-form-with-paypal
Published
2019-06-23
Title
CP Contact Form with Paypal <= 1.3.01 - Multiple XSS
Slug
cp-contact-form-with-paypal
Published
2025-01-29
Title
CP Contact Form with PayPal < 1.3.53 - Cross-Site Request Forgery
Slug
cp-contact-form-with-paypal
Published
2025-11-21
Title
CP Contact Form with PayPal < 1.3.57 - Missing Authorization to Unauthenticated Arbitrary Payment Confirmation
Slug
cp-contact-form-with-paypal
Published
2026-03-02
Title
CP Contact Form with Paypal < 1.3.62 - Authenticated (Contributor+) SQL Injection
Slug
cp-easy-form-builder
Published
2022-08-29
Title
Form Builder CP < 1.2.32 - Admin+ Stored Cross-Site Scripting
Slug
cp-easy-form-builder
Published
2025-01-23
Title
Form Builder CP < 1.2.42 - Authenticated (Contributor+) SQL Injection
Slug
cp-easy-form-builder
Published
2025-01-24
Title
Form Builder CP < 1.2.42 - Authenticated (Contributor+) SQL Injection
Slug
cp-easy-form-builder
Published
2026-05-25
Title
Form Builder CP < 1.2.47 - Editor+ Stored XSS via form_structure
Slug
cp-image-gallery
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
cp-image-gallery
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
cp-image-store
Published
2015-07-10
Title
CP Image Store with Slideshow <= 1.0.5 - Arbitrary File Download
Slug
cp-image-store
Published
2015-07-13
Title
CP Image Store with Slideshow <= 1.0.6 - Purchase ID Brute Force Prevention
Slug
cp-image-store
Published
2022-05-09
Title
CP Image Store with Slideshow < 1.0.68 - Unauthenticated SQLi
Slug
cp-image-store
Published
2026-01-12
Title
CP Image Store with Slideshow < 1.2.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Product Import
Slug
cp-multi-view-calendar
Published
2014-10-26
Title
CP Multi View Event Calendar <= 1.0.1 - SQL Injection
Slug
cp-multi-view-calendar
Published
2015-02-28
Title
CP Multi View Event Calendar <= 1.1.4 - SQL Injection & XSS
Slug
cp-multi-view-calendar
Published
2015-07-10
Title
CP Multi View Event Calendar <= 1.1.7 - Unauthenticated SQL Injection
Slug
cp-multi-view-calendar
Published
2021-07-05
Title
Calendar Event Multi View < 1.4.01 - Unauthenticated Reflected Cross-Site Scripting (XSS)