WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
oshine-modules
Published
2025-01-27
Title
Oshine Modules < 3.3.8 - Reflected Cross-Site Scripting
Slug
osm
Published
2022-09-30
Title
OSM < 6.0.3 - CSRF
Slug
osm
Published
2023-05-03
Title
OSM – OpenStreetMap < 6.0.6 - Contributor+ Stored XSS via Shortcode
Slug
osm
Published
2024-07-08
Title
OSM – OpenStreetMap < 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
osm
Published
2024-07-08
Title
OSM – OpenStreetMap < 6.0.4 - Contributor+ SQL Injection
Slug
osm
Published
2024-09-26
Title
OSM < 6.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via osm_map and osm_map_v3 Shortcodes
Slug
osm
Published
2024-11-08
Title
OSM – OpenStreetMap < 6.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
osm
Published
2025-03-31
Title
OSM – OpenStreetMap < 6.1.14 - Contributor+ Stored XSS
Slug
osm
Published
2026-04-08
Title
OSM < 6.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker_name' Shortcode Attribute
Slug
osm
Published
2026-01-29
Title
OSM – OpenStreetMap < 6.1.13 - Missing Authorization
Slug
osm-map-elementor
Published
2024-06-18
Title
OSM Map Widget for Elementor < 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
Slug
osm-map-elementor
Published
2025-08-28
Title
OSM Map Widget for Elementor < 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL
Slug
osmapper
Published
2022-03-01
Title
OSMapper <= 2.1.5 - Unauthenticated Arbitrary Post Deletion
Slug
osomblocks
Published
2025-06-26
Title
Osom Blocks < 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameter
Slug
oss-aliyun
Published
2024-03-28
Title
OSS Aliyun < 1.4.11 - Authenticated (Administrator+) SQL Injection
Slug
oss-upload
Published
2025-03-24
Title
OSS Upload <= 4.8.9 - Cross-Site Request Forgery
Slug
ossdl-cdn-off-linker
Published
2026-05-26
Title
CDN Linker lite <= 1.3.1 - Cross-Site Request Forgery to Plugin Settings Update
Slug
osticket-wp-bridge
Published
2025-09-19
Title
osTicket WP Bridge <= 1.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
ot-twitter-feed
Published
2025-11-10
Title
Twitter Feed <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
ota-sync-booking-engine-widget
Published
2024-08-20
Title
OTA Sync Booking Engine Widget < 1.3.0 - Settings Update via CSRF
Slug
otm-accessibly
Published
2026-04-14
Title
Accessibly <= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST API
Slug
otp-easy-login-with-mocean
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
otp-login
Published
2024-12-05
Title
Login With OTP < 1.5 - Authentication Bypass via Weak OTP
Slug
otp-login
Published
2026-05-26
Title
Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force
Slug
otpless
Published
2025-04-14
Title
OTP-less one tap Sign in < 2.0.59 - Reflected Cross-Site Scripting