WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
custom-post-type-ui
Published
2020-03-17
Title
Custom Post Type UI < 1.7.4 - CSRF to Stored XSS
Slug
custom-post-type-ui
Published
2023-04-03
Title
Custom Post Type UI < 1.13.5 - Debug Info Sending via CSRF
Slug
custom-post-type-ui
Published
2025-12-03
Title
Custom Post Type UI < 1.18.1 - Unauthenticated Custom Post Type Modification
Slug
custom-post-type-ui
Published
2025-12-12
Title
Custom Post Type UI < 1.18.2 - Admin+ Stored XSS via 'label' Import Parameter
Slug
custom-post-types
Published
2023-10-16
Title
Custom post types < 5.0.3 - Admin+ Stored XSS
Slug
custom-post-types
Published
2023-11-07
Title
Custom post types < 5.0.0 - Admin+ Stored Cross-Site Scripting
Slug
custom-post-types
Published
2024-04-04
Title
Custom post types, Custom Fields & more < 5.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
custom-post-types-image
Published
2025-09-22
Title
Custom Post Type Images <= 0.5 - Cross-Site Request Forgery
Slug
custom-post-view-generator
Published
2021-08-10
Title
Custom Post View Generator <= 0.4.6 - Reflected Cross-Site Scripting
Slug
custom-post-widget
Published
2024-05-07
Title
Content Blocks (Custom Post Widget) < 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
custom-post-widget
Published
2024-05-31
Title
Content Blocks (Custom Post Widget) < 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_block Shortcode
Slug
custom-post-widget
Published
2024-05-31
Title
Content Blocks (Custom Post Widget) < 3.3.1 - Authenticated (Contributor+) Local File Inclusion via Shortcode
Slug
custom-post-widget
Published
2024-09-05
Title
Content Blocks (Custom Post Widget) < 3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
custom-post-widget
Published
2025-02-19
Title
Content Blocks (Custom Post Widget) < 3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter
Slug
custom-posts-order
Published
2025-04-09
Title
Custom Posts Order <= 4.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
custom-product-builder-for-woocommerce
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
custom-product-list-table
Published
2024-06-18
Title
Custom Product List Table <= 3.0.0 - Cross-Site Request Forgery
Slug
custom-product-stickers-for-woocommerce
Published
2025-03-24
Title
Custom Product Stickers for Woocommerce <= 1.9.0 - Reflected Cross-Site Scripting
Slug
custom-product-type-for-woocommerce
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
custom-product-type-for-woocommerce
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
custom-query-shortcode
Published
2025-08-24
Title
Custom Query Shortcode < 0.5.0 - Authenticated (Contributor+) Path Traversal via lens Parameter
Slug
custom-registration-and-login-forms-with-new-recaptcha
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
custom-registration-and-login-forms-with-new-recaptcha
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
custom-registration-form-builder-with-submission-manager
Published
2017-10-02
Title
RegistrationMagic-Custom Registration Forms <= 3.7.9.2 - Unauthenticated PHP Object Injection
Slug
custom-registration-form-builder-with-submission-manager
Published
2017-12-10
Title
RegistrationMagic - Custom Registration Forms < 3.8.0.9 - Authenticated SQL Injection