WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
innovs-woo-manager
Published
2025-06-19
Title
WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily <= 1.2.4.5 - Missing Authorization
Slug
inpost-for-woocommerce
Published
2024-08-16
Title
InPost for WooCommerce <= 1.4.0 and InPost PL <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary File Read and Delete
Slug
inpost-gallery
Published
2016-10-18
Title
InPost Gallery <= 2.1.2 - LFI & Authenticated Stored XSS
Slug
inpost-gallery
Published
2022-11-28
Title
InPost Gallery < 2.1.4.1 - Unauthenticated LFI to RCE
Slug
inpost-gallery
Published
2023-03-22
Title
InPost Gallery < 2.1.4.2 - Reflected XSS
Slug
inpost-gallery
Published
2024-11-25
Title
InPost Gallery < 2.1.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via inpost_gallery_get_shortcode_template
Slug
inpost-gallery
Published
2025-04-11
Title
InPost Gallery < 2.1.4.4 - Cross-Site Request Forgery
Slug
inpost-gallery
Published
2025-09-03
Title
InPost Gallery < 2.1.4.6 - Authenticated (Subscriber+) Local File Inclusion
Slug
inpost-gallery
Published
2026-04-20
Title
InPost Gallery < 2.1.5 - Unauthenticated SQL Injection
Slug
inprosysmedia-likes-dislikes-post
Published
2025-05-20
Title
Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection
Slug
inprosysmedia-likes-dislikes-post
Published
2025-05-27
Title
Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection
Slug
inquiry-cart
Published
2024-05-24
Title
Inquiry Cart <= 3.4.2 - Stored XSS via CSRF
Slug
inquiry-cart
Published
2026-04-21
Title
Inquiry cart <= 3.4.2 - Cross-Site Request Forgery via Settings Form
Slug
inquiry-form-to-posts-or-pages
Published
2026-04-07
Title
Inquiry form to posts or pages <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Header Field
Slug
inquiry-form-to-posts-or-pages
Published
2026-04-14
Title
Inquiry form to posts or pages <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'inq_header' Parameter
Slug
inseri-core
Published
2026-02-25
Title
Scientific and Interactive Blocks – inseri core <= 1.0.5 - Missing Authorization
Slug
insert-code
Published
2025-03-11
Title
Insert Code <= 2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
insert-estimated-reading-time
Published
2023-10-02
Title
Insert Estimated Reading Time <= 1.2 - Admin+ Stored XSS
Slug
insert-headers-and-footers
Published
2023-02-09
Title
WPCode < 2.0.7 - Contributor+ WPCode Library Auth Key Update/Deletion
Slug
insert-headers-and-footers
Published
2023-04-03
Title
WPCode Lite < 2.0.9 - Arbitrary Log File Deletion via CSRF
Slug
insert-headers-and-footers
Published
2023-07-17
Title
WPCode < 2.0.13.1 - Reflected XSS
Slug
insert-headers-and-footers
Published
2026-05-26
Title
WPCode < 2.3.6 - Author+ Remote Code Execution via XML-RPC wp.newPost
Slug
insert-headers-and-footers-script
Published
2025-04-01
Title
Insert Headers and Footers Code – HT Script < 1.1.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
Slug
insert-headers-and-footers-script
Published
2025-11-07
Title
Insert Headers and Footers Code – HT Script < 1.1.7 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
insert-html-here
Published
2025-04-09
Title
Insert HTML Here <= 1.0 - Reflected Cross-Site Scripting