WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
happyforms
Published
2026-10-19
Title
HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer
Slug
hash-elements
Published
2024-03-28
Title
Hash Elements < 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
hash-elements
Published
2024-05-22
Title
Hash Elements < 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter in Multiple Widgets
Slug
hash-elements
Published
2024-11-12
Title
Hash Elements < 1.4.8 - Missing Authorization to Unauthenticated Draft Post Title Exposure
Slug
hash-elements
Published
2025-01-06
Title
Hash Elements < 1.5.1 - Contributor+ Stored XSS
Slug
hash-elements
Published
2026-06-12
Title
Hash Elements < 1.5.5 - Authenticated (Contributor+) Information Exposure
Slug
hash-form
Published
2024-05-22
Title
Hash Form – Drag & Drop Form Builder < 1.1.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution
Slug
hash-form
Published
2024-05-22
Title
Hash Form – Drag & Drop Form Builder < 1.1.1 - Unauthenticated PHP Object Injection
Slug
hash-form
Published
2024-10-04
Title
Hash Form - Drag & Drop Form Builder < 1.2.0 - Unauthenticated Limited File Upload
Slug
hash-form
Published
2024-12-11
Title
Hash Form < 1.2.2 - Missing Authorization to Authenticated (Contributor+) Form Style Creation
Slug
hash-form
Published
2025-05-07
Title
Hash Form < 1.2.9 - Cross-Site Request Forgery
Slug
hash-form
Published
2026-08-24
Title
Hash Form – Drag & Drop Form Builder < 1.4.1 - Cross-Site Request Forgery
Slug
hash-form
Published
2026-08-28
Title
Hash Form – Drag & Drop Form Builder < 1.4.3 - Unauthenticated Arbitrary File Upload
Slug
hash-form
Published
2026-08-25
Title
Hash Form – Drag & Drop Form Builder < 1.4.2 - Unauthenticated PHP Object Injection
Slug
hashbar-wp-notification-bar
Published
2022-12-27
Title
HashBar – WordPress Notification Bar < 1.3.6 - Contributor+ Stored XSS via Shortcode
Slug
hashbar-wp-notification-bar
Published
2023-12-26
Title
HashBar – WordPress Notification Bar < 1.4.2 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
hashbar-wp-notification-bar
Published
2026-08-18
Title
HashBar – Announcement, Notification Bar & Popup Campaign < 2.0.1 - Cross-Site Request Forgery
Slug
hashbar-wp-notification-bar
Published
2026-09-21
Title
HashBar – Announcement, Notification Bar & Popup Campaign < 2.0.4 - Authenticated (Administrator+) SQL Injection
Slug
hashtagger
Published
2025-04-24
Title
Smart Hashtags [#hashtagger] <= 7.2.3 - Missing Authorization
Slug
hashthemes-demo-importer
Published
2021-10-26
Title
HashThemes Demo Importer < 1.1.2 - Improper Access Control to Blog Reset
Slug
hashthemes-demo-importer
Published
2026-07-22
Title
HashThemes Demo Importer < 2.0 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
haxcan
Published
2021-07-05
Title
Haxcan <= 1.0.0 - Arbitrary File Access
Slug
haxcan
Published
2021-07-05
Title
Haxcan <= 1.0.0 - CSRF Bypass
Slug
hb-audio-gallery
Published
2024-11-08
Title
HB AUDIO GALLERY <= 3.0 - Unauthenticated Arbitrary File Upload
Slug
hb-audio-gallery-lite
Published
2026-06-15
Title
HB Audio Gallery Lite <= 1.0.0 - Unauthenticated Arbitrary File Download