WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
drag-and-drop-multiple-file-upload-contact-form-7
Published
2026-08-19
Title
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting
Slug
drag-and-drop-multiple-file-upload-contact-form-7
Published
2026-08-19
Title
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass
Slug
drag-and-drop-multiple-file-upload-for-woocommerce
Published
2023-09-21
Title
Drag and Drop Multiple File Upload < 1.1.1 - Unauthenticated Stored Cross-Site Scripting
Slug
drag-and-drop-multiple-file-upload-for-woocommerce
Published
2025-04-04
Title
Drag and Drop Multiple File Upload for WooCommerce < 1.1.5 - Unauthenticated Arbitrary File Move
Slug
drag-and-drop-multiple-file-upload-for-woocommerce
Published
2025-05-08
Title
Drag and Drop Multiple File Upload for WooCommerce < 1.1.7 - Unauthenticated Arbitrary File Upload via upload Function
Slug
drag-and-drop-multiple-file-upload-for-woocommerce
Published
2026-07-30
Title
Drag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle
Slug
drag-drop-file-uploader
Published
2014-08-01
Title
drag & drop file upload 0.1 - Arbitrary File Upload
Slug
drag-n-drop-upload-cf7-pro
Published
2023-03-21
Title
Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard < 2.11.1 - Reflected Cross-Site Scripting
Slug
drag-n-drop-upload-cf7-pro
Published
2023-03-21
Title
Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations < 5.0.6.4 - Reflected Cross-Site Scripting
Slug
drag-n-drop-upload-cf7-pro
Published
2023-03-08
Title
Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations < 5.0.6.3 - Path Traversal
Slug
drag-n-drop-upload-cf7-pro
Published
2023-03-08
Title
Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard < 2.11.0 - Path Traversal
Slug
dragfy-addons-for-elementor
Published
2023-11-07
Title
Dragfy Addons for Elementor <= 1.0.2 - Missing Authorization via save_settings
Slug
dragon-calendar-free-version
Published
2025-03-31
Title
Multi Days Events and Multi Events in One Day Calendar <= 1.1.3 - Cross-Site Request Forgery
Slug
draw-attention
Published
2023-05-30
Title
Draw Attention < 2.0.12 - Subscriber+ Unauthorized Featured Image Modification
Slug
draw-attention
Published
2023-10-24
Title
Draw Attention < 2.0.16 - Improper Access Control via register_cpt
Slug
drawblog
Published
2014-08-01
Title
drawblog - CSRF
Slug
drawblog
Published
2021-06-28
Title
DrawBlog <= 0.90 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
drawit
Published
2023-11-16
Title
DrawIt (draw.io) <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
dream-gallery
Published
2025-12-04
Title
dream gallery <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'dreampluginsmain' AJAX Action
Slug
dreamgrow-scroll-triggered-box
Published
2024-02-02
Title
Scroll Triggered Box <= 2.3 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
dreamstime-stock-photos
Published
2025-02-02
Title
Dreamstime Stock Photos < 4.2 - Reflected Cross-Site Scripting
Slug
drip-feed-content-extended-for-learndash
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
drive-folder-embeder
Published
2025-06-25
Title
Drive Folder Embedder <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via tablecssclass Parameter
Slug
drivr-google-drive-file-picker
Published
2025-02-18
Title
Drivr Lite – Google Drive Plugin plugin for WordPress <= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
drm-protected-video-streaming
Published
2025-01-07
Title
S3Player – WooCommerce & Elementor Integration <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting