WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
network-summary
Published
2024-03-21
Title
Network Summary <= 2.0.11 - Unauthenticated SQL Injection
Slug
neuvoo-jobroll
Published
2015-11-05
Title
neuvoo-jobroll <= 2.0 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Slug
new-adman
Published
2023-03-03
Title
New Adman <= 1.6.8 - Admin+ Stored XSS
Slug
new-adman
Published
2023-03-03
Title
New Adman <= 1.6.8 - Settings Update via CSRF
Slug
new-album-gallery
Published
2023-07-17
Title
Album Gallery – WordPress Gallery < 1.5.0 - Cross-Site Request Forgery
Slug
new-album-gallery
Published
2024-06-06
Title
Album Gallery – WordPress Gallery < 1.5.8 - Missing Authorization
Slug
new-album-gallery
Published
2025-02-28
Title
Album Gallery – WordPress Gallery < 1.6.4 - Authenticated (Editor+) PHP Object Injection via Gallery Meta
Slug
new-contact-form-widget
Published
2024-05-14
Title
Contact Form Widget < 1.4.0 - Sensitive Information Exposure
Slug
new-contact-form-widget
Published
2024-10-09
Title
Contact Form Widget < 1.4.3 - Cross-Site Request Forgery
Slug
new-contact-form-widget
Published
2025-05-07
Title
Contact Form Widget < 1.4.7 - Cross-Site Request Forgery
Slug
new-contact-form-widget
Published
2025-12-31
Title
Contact Form Widget <= 1.5.1 - Cross-Site Request Forgery
Slug
new-grid-gallery
Published
2021-07-21
Title
Grid Gallery < 1.2.5 - Authenticated Stored Cross Site Scripting (XSS)
Slug
new-grid-gallery
Published
2024-04-29
Title
Grid Gallery < 1.4.4 - Contributor+ PHP Object Injection via shortcode
Slug
new-image-gallery
Published
2024-06-06
Title
Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery < 1.4.6 - Missing Authorization
Slug
new-image-gallery
Published
2026-02-11
Title
Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery <= 1.6.0 - Authenticated (Contributor+) PHP Object Injection
Slug
new-order-notification-for-woocommerce
Published
2024-03-29
Title
New Order Notification for Woocommerce < 2.0.3 - Missing Authorization
Slug
new-order-popup
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
new-photo-gallery
Published
2024-04-29
Title
Photo Gallery < 1.4.3 - Contributor+ PHP Object Injection via Shortcode
Slug
new-royalslider
Published
2024-03-25
Title
RoyalSlider < 3.4.3 - Reflected Cross-Site Scripting
Slug
new-simple-gallery
Published
2025-09-05
Title
New Simple Gallery <= 8.0 - Authenticated (Contributor+) SQL Injection
Slug
new-user-approve
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
new-user-approve
Published
2022-06-01
Title
New User Approve < 2.4 - Arbitrary Settings Update & Invitation Code Creation via CSRF
Slug
new-user-approve
Published
2022-05-30
Title
New User Approve < 2.4.1 - Reflected Cross-Site Scripting
Slug
new-user-approve
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
new-user-approve
Published
2023-12-26
Title
New User Approve < 2.5.2 - Cross-Site Request Forgery via admin_notices