WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
ithemes-sync
Published
2023-11-07
Title
Solid Central < 3.0.1 - Stored Cross-Site Scripting via packages
Slug
ithemes-sync
Published
2026-01-11
Title
Solid Central – Site Management, Backups, Security, and Reporting < 3.2.9 - Missing Authorization
Slug
ithoughts-advanced-code-editor
Published
2025-07-23
Title
iThoughts Advanced Code Editor <= 1.2.10 - Cross-Site Request Forgery to Settings Update
Slug
itracker360
Published
2026-03-20
Title
iTracker360 < 2.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itracker_license' Settings Field
Slug
itsukaita
Published
2026-03-20
Title
itsukaita <= 0.1.2 - Reflected Cross-Site Scripting via 'day_from' Parameter
Slug
itwitter
Published
2014-12-19
Title
iTwitter <= 0.04 - XSS & CSRF
Slug
iubenda-cookie-law-solution
Published
2022-12-12
Title
iubenda < 3.3.3 - Subscriber+ Privileges Escalation to Admin
Slug
iubenda-cookie-law-solution
Published
2026-09-04
Title
iubenda < 3.13.5 - Unauthenticated Stored XSS via AdSense Regex Rewrite
Slug
iubenda-cookie-law-solution
Published
2026-09-04
Title
iubenda < 3.13.5 - Unauthenticated Stored XSS via Comment Content
Slug
iva-business-hours-pro
Published
2021-04-02
Title
Business Hours Pro <= 5.5.0 - Unauthenticated Arbitrary File Upload to RCE
Slug
ivalt
Published
2024-10-09
Title
ivalt plugin contains malicious JS <= 1.0.0
Slug
ivyforms
Published
2026-10-27
Title
The Innovative Form Builder < 1.5.2 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload
Slug
ivysilani-shortcode
Published
2026-03-20
Title
iVysilani Shortcode <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
Slug
iwant-one-ihave-one
Published
2014-08-01
Title
IWantOneButton 3.0.1 - Multiple Vulnerabilities
Slug
iwjob
Published
2025-03-06
Title
InWave Jobs <= 3.5.1 - Unauthenticated Privilege Escalation
Slug
iwjob
Published
2025-06-04
Title
InWave Jobs <= 3.5.8 - Missing Authorization
Slug
iworks-pwa
Published
2024-10-01
Title
PWA — easy way to Progressive Web App < 1.6.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
iwp-client
Published
2014-12-02
Title
InfiniteWP Client <= 1.3.7 - Privilege Escalation
Slug
iwp-client
Published
2015-07-08
Title
InfiniteWP Client <= 1.3.14 - Unspecified Critical
Slug
iwp-client
Published
2017-01-25
Title
InfiniteWP Client < 1.6.1.1 - Unauthenticated PHP Object Injection
Slug
iwp-client
Published
2020-01-14
Title
InfiniteWP Client < 1.9.4.5 - Authentication Bypass
Slug
iwp-client
Published
2023-08-14
Title
InfiniteWP Client < 1.12.1 - Unauthenticated Sensitive Information Exposure
Slug
iwp-client
Published
2024-02-08
Title
InfiniteWP Client < 1.12.3.1 - Unauthenticated Sensitive Information Exposure
Slug
iwp-client
Published
2025-01-07
Title
InfiniteWP Client < 1.13.1 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading
Slug
iwp-client
Published
2026-08-20
Title
InfiniteWP Client < 1.13.10 - Authenticated (Administrator+) SQL Injection