WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
flexible-refund-and-return-order-for-woocommerce
Published
2025-10-21
Title
Flexible Refund and Return Order for WooCommerce < 1.0.39 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refund
Slug
flexible-refund-and-return-order-for-woocommerce
Published
2025-11-07
Title
Flexible Refund and Return Order for WooCommerce < 1.0.43 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update
Slug
flexible-shipping
Published
2022-06-14
Title
Flexible Shipping < 4.11.9 - Reflected Cross-Site Scripting
Slug
flexible-shipping
Published
2024-04-22
Title
Flexible Shipping < 4.24.16 - Missing Authorization
Slug
flexible-shipping-ups
Published
2024-04-11
Title
WooCommerce UPS Shipping – Live Rates and Access Points < 2.2.5 - Cross-Site Request Forgery
Slug
flexible-shipping-ups
Published
2024-10-24
Title
UPS Live Rates and Access Points < 3.0.0 - Missing Authorization to Plugin API key reset
Slug
flexible-shipping-usps
Published
2024-04-10
Title
USPS Shipping for WooCommerce – Live Rates < 1.9.3 - Cross-Site Request Forgery
Slug
flexible-shipping-usps
Published
2024-04-22
Title
USPS Shipping for WooCommerce – Live Rates < 1.10.0 - Sensitive Information Exposure
Slug
flexible-wishlist
Published
2025-01-28
Title
Flexible Wishlist for WooCommerce < 1.2.26 - Unauthenticated Stored Cross-Site Scripting via wishlist_name Parameter
Slug
flexible-wishlist
Published
2025-02-17
Title
Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later < 1.2.27 - Cross-Site Request Forgery to Wishlist Creation/Modification
Slug
flexible-woocommerce-checkout-field-editor
Published
2023-12-05
Title
Flexible Woocommerce Checkout Field Editor <= 2.0.1 - Missing Authorization
Slug
flexidx-home-search
Published
2025-02-03
Title
FlexIDX Home Search <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
flexmls-idx
Published
2024-10-16
Title
Flexmls® IDX Plugin < 3.14.23 - Reflected Cross-Site Scripting
Slug
flexmls-idx
Published
2025-01-24
Title
Flexmls® IDX Plugin < 3.14.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters
Slug
flexmls-idx
Published
2025-02-22
Title
Flexmls® IDX < 3.14.28 - Unauthenticated PHP Object Injection
Slug
flexmls-idx
Published
2025-03-06
Title
Flexmls® IDX < 3.14.29 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
flexmls-idx
Published
2025-11-29
Title
Flexmls® IDX < 3.15.8 - Unauthenticated Open Redirect
Slug
flexo-countdown
Published
2025-06-23
Title
Flexo Counter <= 1.0001 - Reflected Cross-Site Scripting
Slug
flexo-posts-manager
Published
2025-06-14
Title
flexo-posts-manager <= 1.0001 - Reflected Cross-Site Scripting
Slug
flexo-slider
Published
2025-01-16
Title
Flexo Slider <= 1.0013 - Reflected Cross-Site Scripting
Slug
flexo-social-gallery
Published
2025-08-14
Title
flexo-social-gallery <= 1.0006 - Cross-Site Request Forgery
Slug
flexoslider
Published
2025-06-14
Title
flexoslider <= 1.0004 - Reflected Cross-Site Scripting
Slug
flexytalk-widget
Published
2025-04-09
Title
FrescoChat Live Chat <= 3.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
flickr-gallery
Published
2017-10-02
Title
Flickr Gallery <= 1.5.2 - Unauthenticated PHP Object Injection
Slug
flickr-justified-gallery
Published
2015-07-28
Title
Flickr Justified Gallery < 3.4.0 - Reflected Cross-Site Scripting (XSS)