WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
js_composer
Published
2024-04-11
Title
WPBakery Visual Composer < 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute
Slug
js_composer
Published
2024-04-11
Title
WPBakery Visual Composer < 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author
Slug
js_composer
Published
2024-06-12
Title
WPBakery Page Builder < 7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via VC Single Image link attribute
Slug
js_composer
Published
2024-08-05
Title
WPBakery < 7.8 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
js_composer
Published
2024-08-05
Title
WPBakery < 7.8 - Authenticated (Author+) Local File Inclusion
Slug
js_composer
Published
2025-06-18
Title
WPBakery Page Builder < 8.5 - Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder
Slug
js_composer
Published
2025-07-23
Title
WPBakery Page Builder < 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements
Slug
js_composer
Published
2025-08-05
Title
WPBakery Page Builder for WordPress < 8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
js_composer
Published
2025-10-14
Title
WPBakery Page Builder < 8.7 - Stored Cross-Site Scripting via vc_custom_heading Shortcode
Slug
js_composer
Published
2025-10-14
Title
WPBakery Page Builder < 8.7 - Stored Cross-Site Scripting via Custom JS Module
Slug
js_composer
Published
2025-10-17
Title
WPBakery Page Builder < 8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
jsfiddle-shortcode
Published
2024-11-03
Title
JSFiddle Shortcode < 1.1.3 - Contributor+ XSS via Shortcode
Slug
jsm-show-post-meta
Published
2025-01-24
Title
JSM Show Post Metadata < 4.6.1 - Missing Authorization
Slug
jsmol2wp
Published
2019-01-07
Title
JSmol2WP <= 1.07 - Unauthenticated Cross-Site Scripting (XSS)
Slug
jsmol2wp
Published
2018-12-25
Title
JSmol2WP <= 1.07 - Unauthenticated Server Side Request Forgery (SSRF)
Slug
json-api-user
Published
2024-07-10
Title
JSON API User < 3.9.4 - Unauthenticated Privilege Escalation
Slug
json-content-importer
Published
2023-02-15
Title
JSON Content Importer < 1.3.16 - Admin+ Stored XSS
Slug
json-content-importer
Published
2023-12-04
Title
JSON Content Importer < 1.5.4 - Reflected XSS
Slug
json-content-importer
Published
2024-07-11
Title
JSON Content Importer < 1.6.0 - Authenticated (Contributor+) Server-Side Request Forgery
Slug
json-rest-api
Published
2015-04-09
Title
WP REST API (WP API) <= 1.2 - Post Revision Disclosure
Slug
json-rest-api
Published
2014-06-26
Title
JSON REST API 1.1 - JSONP SOP Bypass
Slug
json-rest-api
Published
2015-08-14
Title
WP REST API (WP API) <= 1.2.2 - Cross-Site Scripting (XSS)
Slug
json-structuring-markup
Published
2025-04-01
Title
JSON Structuring Markup <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
jsp-store-locator
Published
2024-11-10
Title
JSP Store Locator <= 1.0 - Contributor+ SQL Injection
Slug
jsp-store-locator
Published
2024-11-10
Title
JSP Store Locator <= 1.0 - Deletion via Missing CSRF