WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
mypixs
Published
2015-09-15
Title
MyPixs <= 0.3 - Unauthenticated Local File Inclusion (LFI)
Slug
myshopkit-popup-smartbar-slidein
Published
2024-02-26
Title
WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit <= 1.0.9 - Unauthenticated Sensitive Information Exposure
Slug
myshouts-shoutbox
Published
2025-09-19
Title
Author: Munzir <= 0.9 - Reflected Cross-Site Scripting
Slug
mystat
Published
2014-08-01
Title
mySTAT <= 2.6 - SQL Injection
Slug
mystickyelements
Published
2022-01-10
Title
All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
mystickyelements
Published
2023-02-06
Title
My Sticky Elements < 2.0.9 - Admin+ SQLi
Slug
mystickyelements
Published
2023-07-03
Title
All-in-one Floating Contact Form < 2.1.2 - Admin+ Stored Cross-Site Scripting
Slug
mystickyelements
Published
2023-12-26
Title
All-in-one Floating Contact Form < 2.1.4 - Unauthenticated Unauthorised Action
Slug
mystickyelements
Published
2025-12-31
Title
My Sticky Elements < 2.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Bulk Lead Deletion
Slug
mystickyelements
Published
2025-12-25
Title
My Sticky Elements < 2.3.4 - Missing Authorization
Slug
mystickymenu
Published
2021-06-21
Title
myStickymenu < 2.5.2 - Authenticated Stored XSS
Slug
mystickymenu
Published
2023-10-27
Title
myStickymenu < 2.6.5 - Subscriber+ Arbitrary Form Leads Deletion
Slug
mystickymenu
Published
2024-01-03
Title
My Sticky Bar < 2.6.7 - CSV Export via CSRF to Sensitive Information Disclosure
Slug
mystickymenu
Published
2024-02-28
Title
My Sticky Bar < 2.6.8 - Admin+ Stored XSS
Slug
mystickymenu
Published
2024-07-11
Title
My Sticky Bar < 2.7.2 - Admin+ Stored XSS
Slug
mystickymenu
Published
2024-08-23
Title
My Sticky Bar < 2.7.3 - Admin+ Stored XSS
Slug
mystyle-custom-product-designer
Published
2025-06-03
Title
MyStyle Custom Product Designer < 3.21.2 - Unauthenticated SQL Injection
Slug
myticket-events
Published
2025-02-21
Title
MyTicket Events <= 1.2.4 - Unauthenticated Limited File Read
Slug
mytreasures
Published
2015-05-14
Title
Multiple Plugins - jQuery prettyPhoto DOM Cross-Site Scripting (XSS)
Slug
mytube
Published
2023-11-28
Title
MyTube PlayList <= 2.0.3 - Reflected Cross-Site Scripting via addplaylistid
Slug
mytweetlinks
Published
2024-10-18
Title
MyTweetLinks <= 1.1.1 - Authenticated (Subscriber+) SQL Injection
Slug
myweather
Published
2024-12-12
Title
addWeather <= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
mywebtonet-performancestats
Published
2025-03-14
Title
PHP/MySQL CPU performance statistics <= 1.2.1 - Unauthenticated PHP Object Injection
Slug
myworks-woo-sync-for-quickbooks-online
Published
2025-04-09
Title
MyWorks WooCommerce Sync for QuickBooks Online < 2.9.2 - Reflected Cross-Site Scripting
Slug
mz-jajak
Published
2014-08-01
Title
Mz-jajak <= 2.1 - index.php id Parameter SQL Injection