WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
music-store
Published
2016-03-28
Title
Music Store < 1.0.43 - Cross-Site Scripting (XSS)
Slug
music-store
Published
2024-06-10
Title
Music Store - WordPress eCommerce < 1.1.14 - Authenticated (Admin+) SQL Injection
Slug
music-store
Published
2024-12-30
Title
Music Store – WordPress eCommerce < 1.2.0 - Reflected Cross-Site Scripting
Slug
music-store
Published
2026-09-03
Title
Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler
Slug
musicbox
Published
2025-01-14
Title
Musicbox <= 2.0.3 - Reflected XSS
Slug
muslim-prayer-time-bd
Published
2024-06-05
Title
Muslim Prayer Time BD < 2.5 - Settings Reset via CSRF
Slug
mutual-funds-data
Published
2026-05-26
Title
Mutual Funds Data <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
Slug
muzaara-adwords-optimize-dashboard
Published
2025-01-06
Title
Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords <= 3.1 - Information Exposure
Slug
muzaara-adwords-optimize-dashboard
Published
2025-01-16
Title
Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords <= 3.1 - Unauthenticated PHP Object Injection
Slug
mw-wp-form
Published
2023-05-15
Title
MW WP Form < 4.4.3 - Unauthenticated Path Traversal
Slug
mw-wp-form
Published
2023-10-19
Title
MW WP Form < 5.0.0 - Missing Authorization
Slug
mw-wp-form
Published
2023-12-04
Title
MW WP Form < 5.0.2 - Unauthenticated Arbitrary File Upload
Slug
mw-wp-form
Published
2023-12-15
Title
MW WP Form < 5.0.4 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion
Slug
mw-wp-form
Published
2024-01-31
Title
MW WP Form < 5.1.0 - Editor+ Stored XSS
Slug
mw-wp-form
Published
2026-04-01
Title
MW WP Form < 5.1.1 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir
Slug
mw-wp-form
Published
2026-04-08
Title
MW WP Form < 5.1.2 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys
Slug
mw-wp-form
Published
2026-05-13
Title
MW WP Form < 5.1.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter
Slug
mw-wp-form
Published
2026-06-01
Title
MW WP Form < 5.1.4 - Unauthenticated Stored Cross-Site Scripting
Slug
mw-wp-form
Published
2026-06-09
Title
MW WP Form < 5.1.4 - Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter
Slug
mw-wp-form
Published
2026-08-27
Title
MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge Tags
Slug
mw-wp-form
Published
2026-08-28
Title
MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List
Slug
mwb-bookings-for-woocommerce
Published
2026-06-26
Title
WPS Bookings for WooCommerce < 3.11.7 - Subscriber+ Arbitrary Booking Order Cancellation via IDOR
Slug
mwb-point-of-sale-pos-for-woocommerce
Published
2021-08-10
Title
MWB Point of Sale (POS) for WooCommerce < 1.0.1 - CSRF Bypass / Unauthorised AJAX Call
Slug
mwb-zendesk-woo-order-sync
Published
2026-08-10
Title
Order Sync with Zendesk for WooCommerce < 2.2.3 - Unauthenticated Customer Order Data Disclosure
Slug
mwp-countdown
Published
2022-03-07
Title
Wow Countdowns <= 3.1.2 - Admin+ SQLi