WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
gwolle-gb
Published
2017-03-01
Title
Gwolle Guestbook <= 2.1.0 - Cross-Site Request Forgery (CSRF)
Slug
gwolle-gb
Published
2017-03-01
Title
Gwolle Guestbook <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting (XSS)
Slug
gwolle-gb
Published
2018-07-28
Title
Gwolle Guestbook <= 2.5.3 - Cross-Site Scripting (XSS)
Slug
gwolle-gb
Published
2021-11-23
Title
Gwolle Guestbook < 4.2.0 - Reflected Cross-Site Scripting
Slug
gwolle-gb
Published
2025-01-31
Title
Gwolle Guestbook < 4.7.2 - Reflected Cross-Site Scripting
Slug
gwolle-gb
Published
2025-07-09
Title
Gwolle Guestbook < 4.9.3 - Unauthenticated Stored Cross-Site Scripting via `gwolle_gb_content` Parameter
Slug
gwp-histats
Published
2024-04-29
Title
GWP-Histats <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
gwyns-imagemap-selector
Published
2022-04-26
Title
Gwyn's Imagemap Selector <= 0.3.3 - Reflected Cross-Site Scripting
Slug
gym-management
Published
2024-11-22
Title
WPGYM < 67.2.0 - Unauthenticated Arbitrary File Upload
Slug
gym-management
Published
2024-11-22
Title
WPGYM < 67.2.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Slug
gym-management
Published
2025-05-16
Title
WPGYM <= 65.0 - Unauthenticated SQL Injection
Slug
gym-management
Published
2025-06-12
Title
WPGYM <= 65.0 - Authenticated (Subscriber+) Local File Inclusion
Slug
gym-management
Published
2025-07-10
Title
WPGYM - Wordpress Gym Management System < 67.8.0 - Unauthenticated SQL Injection
Slug
gym-management
Published
2025-07-08
Title
WPGYM <= 65.0 - Authenticated (Subscriber+) SQL Injection
Slug
gym-management
Published
2025-08-15
Title
WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update
Slug
gym-management
Published
2025-08-15
Title
WPGYM <= 67.7.0 - Missing Authorization to Admin Account Creation
Slug
gym-management
Published
2025-09-09
Title
WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
Slug
gyta-buyback
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
gyta-buyback
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting