WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
jupiterx-core
Published
2024-08-23
Title
Jupiter X Core < 4.6.6 - Unauthenticated Arbitrary File Upload
Slug
jupiterx-core
Published
2024-09-25
Title
Jupiter X Core < 4.7.8 - Limited Unauthenticated Authentication Bypass to Account Takeover
Slug
jupiterx-core
Published
2025-01-06
Title
Jupiter X Core < 4.8.6 - Missing Authorization to Unauthenticated Popup Template Export
Slug
jupiterx-core
Published
2025-01-06
Title
Jupiter X Core < 4.8.6 - Missing Authorization to Authenticated Library Sync
Slug
jupiterx-core
Published
2025-01-31
Title
Jupiter X Core < 4.8.8 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution)
Slug
jupiterx-core
Published
2025-01-31
Title
Jupiterx Core < 4.8.8 - Authenticated (Contributor+) Arbitrary File Read
Slug
jupiterx-core
Published
2025-04-25
Title
Jupiter X Core < 4.8.12 - Unauthenticated PHP Object Injection via PHAR
Slug
jupiterx-core
Published
2025-05-07
Title
JupiterX Core < 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
jupiterx-core
Published
2025-05-16
Title
Jupiterx Core < 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG
Slug
jupiterx-core
Published
2025-09-22
Title
JupiterX Core < 4.11.1 - Contributor+ Stored XSS
Slug
jupiterx-core
Published
2026-01-12
Title
JupiterX Core < 4.11.0 - Authenticated (Contributor+) PHP Object Injection
Slug
just-custom-fields
Published
2023-10-19
Title
Just Custom Fields <= 3.3.2 - Missing Authorization on AJAX Actions
Slug
just-custom-fields
Published
2023-10-19
Title
Just Custom Fields <= 3.3.2 - Cross-Site Request Forgery on AJAX Actions
Slug
just-custom-fields
Published
2024-07-08
Title
Just Custom Fields <= 3.3.2 - Missing Authorization via AJAX actions
Slug
just-custom-fields
Published
2024-07-08
Title
Just Custom Fields <= 3.3.2 - Cross-Site Request Forgery via AJAX actions
Slug
just-highlight
Published
2025-11-24
Title
Just Highlight <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Highlight Color' Setting
Slug
just-post-preview
Published
2025-04-04
Title
Just Post Preview Widget <= 1.1.1 - Authenticated (Contributor+) Local File Inclusion
Slug
just-tables
Published
2023-03-30
Title
JustTables – WooCommerce Product Table < 1.5.0 - Cross-Site Request Forgery
Slug
just-tinymce-styles
Published
2025-12-08
Title
Just TinyMCE Custom Styles <= 1.2.1 - Cross-Site Request Forgery
Slug
just-wp-variables
Published
2025-02-24
Title
Just Variables <= 1.2.3 - Cross-Site Request Forgery
Slug
just-writing-statistics
Published
2024-05-30
Title
Just Writing Statistics < 4.6 - Authenticated (Admin+) Stored Cross-Site Scripting
Slug
just-writing-statistics
Published
2024-12-30
Title
Just Writing Statistics < 4.8 - Authenticated (Administrator+) SQL Injection
Slug
just-writing-statistics
Published
2025-03-27
Title
Just Writing Statistics < 5.4 - Missing Authorization
Slug
justclick-subscriber
Published
2026-01-23
Title
JustClick registration plugin <= 0.1 - Reflected Cross-Site Scripting via PHP_SELF
Slug
justified-gallery
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius