WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
kiotvietsync
Published
2025-10-20
Title
KiotViet Sync <= 1.8.5 - Missing Authorization
Slug
kiotvietsync
Published
2025-11-04
Title
KiotViet Sync <= 1.8.5 - Unauthenticated Webhook Key Exposure
Slug
kiotvietsync
Published
2025-11-04
Title
KiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Upload
Slug
kiotvietsync
Published
2025-11-04
Title
KiotViet Sync <= 1.8.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Slug
kiotvietsync
Published
2025-11-04
Title
KiotViet Sync <= 1.8.5 - Authorization Bypass via Use of Hard-coded Password
Slug
kirilkirkov-pdf-invoice-manager
Published
2026-02-10
Title
Invoct – PDF Invoices & Billing for WooCommerce < 1.7 - Missing Authorization to Authenticated (Subscriber+) Information Exposure
Slug
kirimemail-woocommerce-integration
Published
2025-12-11
Title
Kirim.Email WooCommerce Integration <= 1.2.9 - Cross-Site Request Forgery to Settings Update
Slug
kirki
Published
2026-05-19
Title
Kirki < 6.0.7 - Subscriber+ Sensitive Data Exposure via kirki_wp_admin_get_apis Action
Slug
kirki
Published
2026-05-19
Title
Kirki < 6.0.7 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
Slug
kirki
Published
2026-06-01
Title
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
Slug
kirki
Published
2026-07-01
Title
Kirki < 6.0.12 - Unauthenticated Sensitive Data Exposure via kirki_post_apis_nopriv AJAX Action
Slug
kirki
Published
2026-06-26
Title
Kirki < 6.0.12 - Subscriber+ Server-Side Request Forgery
Slug
kirki
Published
2026-07-06
Title
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.12 - Unauthenticated Stored Cross-Site Scripting
Slug
kirki
Published
2026-07-06
Title
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.1.0 - Unauthenticated Missing Authorization
Slug
kirki
Published
2026-06-29
Title
Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password
Slug
kirki
Published
2026-07-16
Title
Kirki < 6.0.14 - Editor+ Path Traversal to Arbitrary Directory Deletion via family
Slug
kirki
Published
2026-06-29
Title
Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library
Slug
kirki
Published
2026-06-29
Title
Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis
Slug
kirki
Published
2026-07-01
Title
Kirki < 6.0.12 - Unauthenticated Arbitrary Email Content Injection via emailBody and emailSubject Parameters
Slug
kirki
Published
2026-07-14
Title
Kirki < 6.0.13 - Unauthenticated PHP Object Injection
Slug
kirki
Published
2026-07-14
Title
Kirki < 6.0.13 - Unauthenticated SQL Injection
Slug
kish-guest-posting
Published
2014-08-01
Title
Kish Guest Posting 1.2 - Arbitrary File Upload
Slug
kitestudio-core
Published
2022-06-15
Title
Core Plugin for Kitestudio Themes < 2.3.1 - Reflected Cross-Site-Scripting
Slug
kivicare-clinic-management-system
Published
2022-05-23
Title
KiviCare < 2.3.9 - Unauthenticated SQLi
Slug
kivicare-clinic-management-system
Published
2023-06-05
Title
KiviCare Management System < 3.2.1 - Reflected Cross-Site Scripting