WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
downloader-tiktok
Published
2021-04-13
Title
Video Downloader for TikTok < 1.4 - Server Side Request Forgery (SSRF) & Local File Inclusion (LFI)
Slug
downloadmanager
Published
2024-04-12
Title
Download Manager < 3.2.83 - Unauthenticated Password Protected File Bypass
Slug
downloads-manager
Published
2014-08-01
Title
Download Manager 0.2 - Arbitrary File Upload Exploit
Slug
dp-addthis
Published
2024-10-31
Title
(dp) AddThis <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
dp-alterminator-missing-alt-manager
Published
2025-03-11
Title
DP ALTerminator - Missing ALT manager <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
dp-intro-tours
Published
2024-12-03
Title
Intro Tour Tutorial DeepPresentation < 6.5.3 - Reflected Cross-Site Scripting
Slug
dp-maintenance-mode-lite
Published
2015-05-14
Title
Multiple Plugins - jQuery prettyPhoto DOM Cross-Site Scripting (XSS)
Slug
dp-thumbnail
Published
2014-08-01
Title
DP Thumbnail 1.0 - Shell Upload
Slug
dpepress
Published
2025-05-20
Title
DPEPress <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
dpt-oauth-client
Published
2022-10-21
Title
OAuth Client by DigitialPixies <= 1.1.0 - Admin+ Stored Cross-Site Scripting
Slug
dpt-oauth-client
Published
2022-10-21
Title
OAuth Client by DigitialPixies <= 1.1.0 - CSRF
Slug
dr-affiliate
Published
2024-12-14
Title
Dr Affiliate <= 1.2.3 - Authenticated (Subscriber+) SQL Injection
Slug
dr-flex
Published
2025-03-27
Title
Dr. Flex < 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
dr-widgets-blocks
Published
2024-11-01
Title
Delisho < 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
dr-widgets-blocks
Published
2025-09-26
Title
Delisho < 1.1.4 - Missing Authorization
Slug
dracula-dark-mode
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
dracula-dark-mode
Published
2024-03-25
Title
Dracula Dark Mode - The Revolutionary Dark Mode Plugin For WordPress < 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Slug
draft-notify
Published
2025-12-21
Title
Draft Notify <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
drag-and-drop-custom-sidebar
Published
2025-01-16
Title
REAL WordPress Sidebar <= 0.1 - Unauthenticated Stored Cross-Site Scripting
Slug
drag-and-drop-file-upload-for-elementor-forms
Published
2025-05-15
Title
Drag and Drop File Upload for Elementor Forms < 1.5.0 - Unauthenticated Arbitrary File Deletion
Slug
drag-and-drop-file-upload-for-elementor-forms
Published
2025-08-26
Title
Drag and Drop File Upload for Elementor Forms < 1.5.4 - Unauthenticated Arbitrary File Upload
Slug
drag-and-drop-file-uploads-wc-pro
Published
2025-07-01
Title
Drag and Drop Multiple File Upload (Pro) - WooCommerce < 5.0.7 and 5.0 - 5.0.5 - Unauthenticated Arbitrary File Upload
Slug
drag-and-drop-form-builder-for-contact-form-7
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
drag-and-drop-form-builder-for-contact-form-7
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
drag-and-drop-multiple-file-upload-contact-form-7
Published
2020-05-26
Title
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.3.3 - Unauthenticated File Upload Bypass