WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
hide-my-wp
Published
2026-09-16
Title
WP Ghost (Hide My WP Ghost) 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass via WooCommerce Request Parameters
Slug
hide-my-wp
Published
2026-09-16
Title
WP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility Check
Slug
hide-my-wp
Published
2026-09-18
Title
WP Ghost (Hide My WP Ghost) < 7.0.03 - Unauthenticated Open Redirect via 'redirect_to' Parameter
Slug
hide-my-wp
Published
2026-10-15
Title
WP Ghost (Hide My WP Ghost) < 7.0.13 - Unauthenticated Stored XSS via Comment Content
Slug
hide-plugins
Published
2025-12-31
Title
Hide Plugins <= 1.0.4 - Missing Authorization
Slug
hide-price-until-login
Published
2026-10-27
Title
Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration
Slug
hide-real-download-path
Published
2025-09-05
Title
Hide Real Download Path <= 1.6 - Cross-Site Request Forgery
Slug
hide-shipping-method-for-woocommerce
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
hide-shipping-method-for-woocommerce
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
hide-shipping-method-for-woocommerce
Published
2025-01-31
Title
Hide Shipping Method For WooCommerce < 1.5.2 - Missing Authorization
Slug
hide-shipping-method-for-woocommerce
Published
2026-10-01
Title
Hide Shipping Method For WooCommerce < 1.5.5 - Authenticated (Editor+) PHP Object Injection
Slug
hide-text-shortcode
Published
2025-08-13
Title
Hide Text Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
hide-wp-login
Published
2026-07-09
Title
Hide My WP Lite <= 1.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'he_wrapper_js' Parameter
Slug
hide-wp-toolbar
Published
2025-09-22
Title
Hide WP Toolbar <= 2.7 - Missing Authorization
Slug
hide_my_wp
Published
2015-07-27
Title
Hide My WP < 4.52 - Stored Cross-Site Scripting (XSS)
Slug
hide_my_wp
Published
2015-08-13
Title
Hide My WP <= 4.53 - Stored-Cross Site Scripting (XSS)
Slug
hide_my_wp
Published
2021-11-24
Title
Hide My WP < 6.2.4 - Unauthenticated Plugin Deactivation
Slug
hide_my_wp
Published
2021-11-24
Title
Hide My WP < 6.2.4 - Unauthenticated SQL Injection
Slug
hide_my_wp
Published
2021-11-24
Title
Hide My WP < 6.2.4 - Unauthenticated SQLi
Slug
hide_my_wp
Published
2021-11-24
Title
Hide My WP < 6.2.4 - Unauthenticated Reset Token Disclosure
Slug
hide_my_wp
Published
2023-01-11
Title
Hide My WP < 6.2.9 - Unauthenticated SQLi
Slug
hide_my_wp
Published
2026-01-13
Title
Hide My WP <= 6.2.12 - Reflected Cross-Site Scripting
Slug
hidepost
Published
2025-06-27
Title
HidePost <= 2.3.8 - Cross-Site Request Forgery
Slug
hidepost
Published
2025-09-26
Title
HidePost <= 2.3.8 - Cross-Site Request Forgery
Slug
highland-software-custom-role-manager
Published
2026-04-26
Title
Highland Software Custom Role Manager < 1.0.1 - Authenticated (Subscriber+) Privilege Escalation