WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
omnisend-connect
Published
2023-11-07
Title
Email Marketing for WooCommerce by Omnisend < 1.13.9 - Sensitive Information Exposure
Slug
omnisend-connect
Published
2024-04-11
Title
Email Marketing for WooCommerce by Omnisend < 1.14.4 - Cross-Site Request Forgery
Slug
omnisend-connect
Published
2026-05-13
Title
Omnisend for WooCommerce < 1.18.1 - Unauthenticated Omnisend Account Takeover via Predictable Connect Token
Slug
omnishop
Published
2025-07-22
Title
Omnishop <= 1.0.9 - Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST Endpoint
Slug
omnishop
Published
2025-07-22
Title
Omnishop <= 1.0.9 - Cross-Site Request Forgery to Arbitrary User Deletion via /users/delete REST Endpoint
Slug
omplag
Published
2025-12-11
Title
Complag <= 1.0.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Slug
onceki-yazi-linki
Published
2025-02-24
Title
Önceki Yazı Link <= 1.3 - Cross-Site Request Forgery
Slug
onclick-show-popup
Published
2015-05-14
Title
Multiple Plugins - jQuery prettyPhoto DOM Cross-Site Scripting (XSS)
Slug
onclick-show-popup
Published
2023-10-02
Title
Onclick Show Popup < 6.6 - Admin+ Stored XSS
Slug
one-backend-language
Published
2025-01-16
Title
One Backend Language <= 1.0 - Reflected Cross-Site Scripting
Slug
one-click-close-comments
Published
2024-07-26
Title
One Click Close Comments <= 2.7.1 - Unauthenticated Full Path Disclosure
Slug
one-click-demo-import
Published
2022-03-21
Title
One Click Demo Import < 3.1.0 - Admin+ Arbitrary File Upload
Slug
one-click-demo-import
Published
2024-05-07
Title
One Click Demo Import < 3.2.1 - Authenticated (Admin+) PHP Object Injection
Slug
one-click-login
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
one-click-login-as-user
Published
2026-04-14
Title
Login as User <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation via 'oclaup_original_admin' Cookie
Slug
one-click-order-reorder
Published
2024-07-03
Title
One Click Order Re-Order < 1.1.10 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
one-click-plugin-updater
Published
2022-05-23
Title
One Click Plugin Updater <= 2.4.14 - Arbitrary Settings Update via CSRF
Slug
one-click-ssl
Published
2019-07-11
Title
One Click SSL <= 1.4.6 - Multiple Issues
Slug
one-login
Published
2025-06-09
Title
One-Login <= 1.4 - Unauthenticated Privilege Esclation
Slug
one-page-blocks
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
one-page-blocks
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Slug
one-page-blocks
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
one-page-express-companion
Published
2024-06-06
Title
One Page Express Companion < 1.6.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via one_page_express_contact_form Shortcode
Slug
one-page-express-companion
Published
2025-10-16
Title
One Page Express Companion < 1.6.44 - Missing Authorization
Slug
one-user-avatar
Published
2021-09-20
Title
One User Avatar < 2.3.7 - Contributor+ Stored Cross-Site Scripting