WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
hblpay-payment-gateway-for-woocommerce
Published
2026-01-06
Title
HBLPAY Payment Gateway for WooCommerce < 6.0.0 - Reflected Cross-Site Scripting via 'cusdata' Parameter
Slug
hbook
Published
2026-07-29
Title
HBook < 2.1.10 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters
Slug
hc-custom-wp-admin-url
Published
2022-05-18
Title
HC Custom WP-Admin URL <= 1.4 - Unauthenticated Arbitrary Settings Update via CSRF
Slug
hc-custom-wp-admin-url
Published
2022-05-18
Title
HC Custom WP-Admin URL <= 1.4 - Unauthenticated Secret URL Disclosure
Slug
hcaptcha-for-forms-and-more
Published
2024-04-19
Title
hCaptcha for WordPress < 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7-hcaptcha Shortcode
Slug
hcaptcha-for-forms-and-more
Published
2026-01-26
Title
hCaptcha for WP < 4.23.0 - Missing Authorization
Slug
hcaptcha-for-forms-and-more
Published
2026-10-01
Title
hCaptcha for WP < 5.4.0 - Unauthenticated Captcha Verification Bypass
Slug
hcv4-payment-gateway
Published
2025-09-23
Title
HieCOR Payment Gateway Plugin < 2.0.0 - Unauthenticated SQL Injection
Slug
hd-quiz
Published
2021-07-26
Title
HD Quiz < 1.8.4 - Authenticated Stored XSS
Slug
hd-quiz
Published
2024-01-16
Title
HD Quiz < 1.8.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Slug
hd-quiz
Published
2024-11-15
Title
HD Quiz < 2.0.0 - Editor+ Stored XSS
Slug
hd-quiz
Published
2026-01-24
Title
HD Quiz < 2.0.10 - Missing Authorization
Slug
hd-quiz
Published
2026-06-26
Title
HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers
Slug
hd-quiz-save-results-light
Published
2024-10-21
Title
HD Quiz – Save Results Light < 0.6 - Missing Authorization
Slug
hd-webplayer
Published
2012-08-28
Title
Plugin HD Webplayer <= 1.1 - SQL Injections
Slug
hdforms
Published
2026-01-13
Title
HDForms < 1.6.2 - Unauthenticated Arbitrary File Deletion
Slug
hdw-player-video-player-video-gallery
Published
2014-09-19
Title
HDW Player 2.4.2 - wp-admin/admin.php videos Page id Parameter SQL Injection
Slug
hdw-player-video-player-video-gallery
Published
2023-11-29
Title
HDW Player Plugin (Video Player & Video Gallery) <= 5.0 - Cross-Site Scripting
Slug
hdw-tube
Published
2016-04-12
Title
HDW WordPress Video Gallery <= 1.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Slug
head-meta-data
Published
2025-12-14
Title
Head Meta Data < 20251118 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
head-meta-data
Published
2026-01-20
Title
Head Meta Data < 20260105 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta
Slug
header-and-footer-script-adder
Published
2025-12-12
Title
Header Footer Script Adder – Insert Code in Header, Body & Footer < 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
header-and-footer-script-adder
Published
2026-07-22
Title
Header Footer Script Adder < 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta
Slug
header-and-footer-scripts
Published
2026-01-08
Title
Header and Footer Scripts < 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
header-enhancement
Published
2021-09-20
Title
Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change