WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
envira-gallery-lite
Published
2025-11-12
Title
Gallery Plugin for WordPress – Envira Photo Gallery < 1.12.1 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions
Slug
envira-gallery-lite
Published
2026-03-03
Title
Envira Gallery for WordPress < 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST API
Slug
envira-gallery-lite
Published
2026-05-13
Title
Envira Gallery < 1.12.5 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter
Slug
envira-gallery-lite
Published
2026-06-15
Title
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More < 1.12.6 - Missing Authorization
Slug
envira-gallery-lite
Published
2026-08-27
Title
Envira Gallery < 1.12.5 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description
Slug
envira-gallery-lite
Published
2026-10-09
Title
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More < 1.16.2 - Missing Authorization
Slug
envira-gallery-lite
Published
2026-10-05
Title
Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Image ID
Slug
envira-gallery-lite
Published
2026-10-05
Title
Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions
Slug
envira-gallery-lite
Published
2026-10-09
Title
Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard
Slug
envira-gallery-lite
Published
2026-10-09
Title
Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field
Slug
envira-gallery-lite
Published
2026-10-09
Title
Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route
Slug
envira-gallery-lite
Published
2026-10-09
Title
Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode
Slug
envision-page-builder
Published
2026-07-02
Title
Envision Page Builder – A collection of WordPress Gutenberg blocks & templates <= 0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
envo-elementor-for-woocommerce
Published
2024-02-27
Title
Envo's Elementor Templates & Widgets for WooCommerce < 1.4.5 - Arbitrary Theme Activation via CSRF
Slug
envo-elementor-for-woocommerce
Published
2024-02-27
Title
Envo's Elementor Templates & Widgets for WooCommerce < 1.4.5 - Subscriber+ Template Creation
Slug
envo-elementor-for-woocommerce
Published
2024-02-27
Title
Envo's Elementor Templates & Widgets for WooCommerce < 1.4.5 - Arbitrary Plugin Activation via CSRF
Slug
envo-elementor-for-woocommerce
Published
2024-05-10
Title
Envo's Elementor Templates & Widgets for WooCommerce < 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
envo-elementor-for-woocommerce
Published
2024-08-16
Title
Envo's Elementor Templates & Widgets for WooCommerce < 1.4.17 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
envo-elementor-for-woocommerce
Published
2024-10-24
Title
Envo's Elementor Templates & Widgets for WooCommerce < 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
envo-elementor-for-woocommerce
Published
2026-07-01
Title
Envo's Templates & Widgets for Elementor and WooCommerce < 1.4.27 - Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting
Slug
envo-extra
Published
2023-10-17
Title
Envo Extra < 1.8.4 - Cross-Site Request Forgery
Slug
envo-extra
Published
2024-04-15
Title
Envo Extra < 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
envo-extra
Published
2024-05-15
Title
Envo Extra < 1.8.17 - Authenticated (Contributor+) Cross-Site Scripting
Slug
envo-extra
Published
2024-06-06
Title
Envo Extra < 1.8.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget
Slug
envo-extra
Published
2024-11-08
Title
Envo Extra < 1.9.4 - Authenticated (Contributor+) Post Disclosure