WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
oceanpayment-creditcard-gateway
Published
2025-10-14
Title
Oceanpayment CreditCard Gateway <= 6.0 - Unauthenticated Order Status Update
Slug
ocim-mp3
Published
2016-03-07
Title
Ocim MP3 Plugin - Unauthenticated Reflected Cross-Site Scripting (XSS)
Slug
octrace-support
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
octrace-support
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
octrace-support
Published
2024-12-11
Title
WordPress HelpDesk & Support Ticket System Plugin – Octrace Support <= 1.2.7 - Reflected Cross-Site Scripting
Slug
octrace-support
Published
2025-01-14
Title
WordPress HelpDesk & Support Ticket System Plugin – Octrace Support <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
od-photogallery-plugin
Published
2024-12-17
Title
odPhotogallery <= 0.5.3 - Reflected Cross-Site Scripting
Slug
odihost-easy-redirect-301
Published
2025-03-24
Title
Easy 301 Redirects <= 1.33 - Cross-Site Request Forgery
Slug
odihost-newsletter-plugin
Published
2014-08-01
Title
OdiHost Newsletter <= 1.0 - SQL Injection
Slug
oembed-gist
Published
2024-01-03
Title
oEmbed Gist <= 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
off-canvas-sidebars
Published
2024-03-25
Title
Off-Canvas Sidebars & Menus (Slidebars) < 0.5.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
off-canvas-sidebars
Published
2025-03-27
Title
Off-Canvas Sidebars & Menus (Slidebars) < 0.5.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
off-canvas-sidebars
Published
2025-06-23
Title
Off-Canvas Sidebars & Menus (Slidebars) < 0.5.8.5 - Reflected Cross-Site Scripting
Slug
off-canvas-sidebars
Published
2025-08-24
Title
Off-Canvas Sidebars & Menus (Slidebars) < 0.5.9 - Cross-Site Request Forgery
Slug
off-canvas-sidebars
Published
2026-10-22
Title
Off-Canvas Sidebars & Menus (Slidebars) < 0.5.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
off-page-seo
Published
2025-03-19
Title
Off Page SEO <= 3.0.3 - Reflected Cross-Site Scripting
Slug
office-locator
Published
2024-11-20
Title
Office Locator <= 1.3.0 - Authenticated (Contributor+) Local File Inclusion
Slug
office-locator
Published
2025-04-15
Title
Office Locator <= 1.3.0 - Unauthenticated SQL Injection
Slug
official-facebook-pixel
Published
2021-03-25
Title
Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings Deletion
Slug
official-facebook-pixel
Published
2021-03-25
Title
Facebook for WordPress < 3.0.0 - PHP Object Injection with POP Chain
Slug
official-facebook-pixel
Published
2026-07-31
Title
Meta pixel for WordPress < 5.2.2 - Unauthenticated Stored XSS
Slug
official-mailerlite-sign-up-forms
Published
2020-05-25
Title
Official MailerLite Sign Up Forms < 1.4.4 - Unauthenticated SQL Injection
Slug
official-mailerlite-sign-up-forms
Published
2020-05-25
Title
Official MailerLite Sign Up Forms < 1.4.5 - Multiple CSRF Issues
Slug
official-mailerlite-sign-up-forms
Published
2022-05-18
Title
MailerLite < 1.5.4 - Reflected Cross-Site Scripting
Slug
official-mailerlite-sign-up-forms
Published
2022-08-01
Title
MailerLite - Signup forms (official) < 1.5.8 - API Key Update via CSRF