WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
funnelforms-free
Published
2024-08-27
Title
Funnelforms Free < 3.7.4.1 - Authenticated (Administrator+) Arbitrary File Upload
Slug
funnelforms-free
Published
2024-08-27
Title
Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free < 3.7.4.1 - Missing Authorization to Unauthenticated Arbitrary Media Upload
Slug
funnelforms-free
Published
2024-08-28
Title
Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free < 3.7.4.1 - Missing Authorization to Unauthenticated Arbitrary Media Deletion
Slug
funnelforms-free
Published
2024-12-03
Title
Funnelforms Free <= 3.7.5.1 - Authenticated (Contributor+) PHP Object Injection
Slug
funnelforms-free
Published
2025-12-31
Title
Funnelforms Free <= 3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
funnelforms-free
Published
2025-12-25
Title
Funnelforms Free <= 3.8 - Missing Authorization
Slug
furikake
Published
2018-01-01
Title
furikake - Unauthenticated Open Redirect
Slug
furnob-core
Published
2023-12-07
Title
Multiple Plugins by KlbTheme - Reflected Cross-Site Scripting
Slug
fuse-social-floating-sidebar
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
fuse-social-floating-sidebar
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
fuse-social-floating-sidebar
Published
2024-08-07
Title
Fuse Social Floating Sidebar < 5.4.11 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload
Slug
fusedesk
Published
2025-02-11
Title
FuseDesk < 6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusedesk
Published
2025-04-23
Title
FuseDesk < 6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via successredirect Parameter
Slug
fusewp
Published
2025-10-24
Title
FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) < 1.1.23.1 - Cross-Site Request Forgery to Sync Rule Creation
Slug
fusewp
Published
2025-10-30
Title
FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) < 1.1.23.1 - Missing Authorization to Authenticated (Subscriber+) Sync Rule Creation
Slug
fusion
Published
2024-07-10
Title
Fusion < 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion
Published
2025-03-31
Title
Fusion <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion-builder
Published
2022-04-19
Title
Fusion Builder < 3.6.2 - Unauthenticated SSRF
Slug
fusion-builder
Published
2023-08-10
Title
Fusion Builder < 3.11.2 - Cross Site Scripting (XSS) vulnerability in the User Register element
Slug
fusion-builder
Published
2024-09-12
Title
Avada | Website Builder For WordPress & eCommerce < 3.11.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode
Slug
fusion-builder
Published
2024-12-24
Title
Avada Builder < 3.11.13 - Authenticated (Contributor+) Protected Post Disclosure
Slug
fusion-builder
Published
2025-01-22
Title
Avada Builder < 3.11.12 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets
Slug
fusion-builder
Published
2025-02-12
Title
Avada Builder < 3.11.14 - Unauthenticated Arbitrary Shortcode Execution
Slug
fusion-builder
Published
2025-03-31
Title
Avada Builder < 3.11.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
fusion-builder
Published
2025-07-15
Title
Avada (Fusion) Builder < 3.12.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode