WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
gwp-histats
Published
2024-04-29
Title
GWP-Histats <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
gwyns-imagemap-selector
Published
2022-04-26
Title
Gwyn's Imagemap Selector <= 0.3.3 - Reflected Cross-Site Scripting
Slug
gyan-elements
Published
2026-02-01
Title
Gyan Elements < 2.2.2 - Authenticated (Contributor+) Local File Inclusion
Slug
gym-management
Published
2024-11-22
Title
WPGYM < 67.2.0 - Unauthenticated Arbitrary File Upload
Slug
gym-management
Published
2024-11-22
Title
WPGYM < 67.2.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Slug
gym-management
Published
2025-05-16
Title
WPGYM <= 65.0 - Unauthenticated SQL Injection
Slug
gym-management
Published
2025-06-12
Title
WPGYM <= 65.0 - Authenticated (Subscriber+) Local File Inclusion
Slug
gym-management
Published
2025-07-10
Title
WPGYM - Wordpress Gym Management System < 67.8.0 - Unauthenticated SQL Injection
Slug
gym-management
Published
2025-07-08
Title
WPGYM <= 65.0 - Authenticated (Subscriber+) SQL Injection
Slug
gym-management
Published
2025-08-15
Title
WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update
Slug
gym-management
Published
2025-08-15
Title
WPGYM <= 67.7.0 - Missing Authorization to Admin Account Creation
Slug
gym-management
Published
2025-09-09
Title
WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
Slug
gyta-buyback
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
gyta-buyback
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
gzseo
Published
2026-01-23
Title
GZSEO < 2.0.12 - Authenticated (Contributor+) Authorization Bypass to Stored Cross-Site Scripting