WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
hostel
Published
2025-03-27
Title
Hostel < 1.1.5.5 - Reflected Cross-Site Scripting
Slug
hostel
Published
2025-04-16
Title
Hostel < 1.1.5.7 - Authenticated (Administrator+) SQL Injection
Slug
hostel
Published
2025-06-19
Title
Hostel < 1.1.5.8 - Reflected XSS
Slug
hostel
Published
2025-06-19
Title
Hostel < 1.1.5.9 - Admin+ Stored XSS
Slug
hostel
Published
2025-11-27
Title
Hostel < 1.1.6 - Reflected Cross-Site Scripting
Slug
hostel
Published
2026-04-17
Title
Hostel < 1.1.7 - Reflected Cross-Site Scripting via 'shortcode_id' Parameter
Slug
hostel
Published
2026-07-09
Title
Hostel < 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' Shortcode
Slug
hostfact-bestelformulier-integratie
Published
2024-12-11
Title
HostFact bestelformulier integratie < 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
hostinger
Published
2024-01-05
Title
Hostinger < 1.9.8 - Unauthenticated Maintenance Mode Toggle
Slug
hostinger-reach
Published
2026-05-12
Title
Hostinger Reach < 1.3.9 - Subscriber+ Arbitrary API Key Update
Slug
hot-linked-image-cacher
Published
2022-05-17
Title
Hot Linked Image Cacher <= 1.16 - Image upload/cache abuse via CSRF
Slug
hot-random-image
Published
2024-03-25
Title
Hot Random Image < 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
hot-random-image
Published
2025-05-21
Title
Hot Random Image < 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameter
Slug
hot-random-image
Published
2025-05-21
Title
Hot Random Image < 1.9.3 - Path Traversal to Authenticated (Contributor+) Limited Arbitrary Image Access via path Parameter
Slug
hotel-listing
Published
2021-10-28
Title
Hotel Listing < 1.3.3 - Authenticated Stored Cross-Site Scripting
Slug
hotel-listing
Published
2023-03-06
Title
Multiple e-plugins - Subscriber+ Privilege Escalation
Slug
hotel-listing
Published
2025-08-30
Title
Hotel Listing <= 1.4.0 - Subscriber+ Privilege Escalation
Slug
hotel-listing
Published
2025-12-31
Title
Hotel Listing <= 1.4.0 - Reflected Cross-Site Scripting
Slug
hotel-listing
Published
2026-01-22
Title
Hotel Listing <= 1.4.2 - Missing Authorization
Slug
hotel-listing
Published
2026-01-22
Title
Hotel Listing <= 1.4.2 - Missing Authorization
Slug
hotelrunner
Published
2025-09-26
Title
HotelRunner Booking Widget < 1.7 - Cross-Site Request Forgery
Slug
hotelrunner
Published
2025-11-20
Title
HotelRunner Booking Widget <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
hotjar
Published
2023-10-05
Title
Hotjar < 1.0.16 - Admin+ Stored XSS
Slug
hotjar-connecticator
Published
2021-05-04
Title
Hotjar Connecticator <= 1.1.1 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
hotjar-connecticator
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius