WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
online-accessibility
Published
2025-04-09
Title
Accessibility Suite by Online ADA < 4.19 - Authenticated (Subscriber+) SQL Injection
Slug
online-accessibility
Published
2025-06-05
Title
Accessibility Suite < 4.20 - Missing Authorization
Slug
online-accessibility
Published
2026-04-15
Title
Accessibility Suite by Ability, Inc <= 4.20 - Authenticated (Subscriber+) SQL Injection via 'scan_id' Parameter
Slug
online-appointment-scheduling-software
Published
2025-01-16
Title
Swift Calendar Online Appointment Scheduling <= 1.3.3 - Reflected Cross-Site Scripting
Slug
online-booking-engine
Published
2025-09-22
Title
eZee Online Hotel Booking Engine <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
online-lesson-booking-system
Published
2019-06-10
Title
Online Lesson Booking <= 0.8.6 - CSRF & XSS
Slug
onlinecontract
Published
2025-03-04
Title
WP Online Contract <= 5.1.4 - Missing Authorization to Unauthenticated Settings Import
Slug
only-tweet-like-share-and-google-1
Published
2023-07-05
Title
Simple Light Weight Social Share <= 2.0 - Admin+ Stored XSS
Slug
onlyoffice
Published
2024-12-05
Title
ONLYOFFICE Docs < 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
onlyoffice
Published
2025-07-23
Title
ONLYOFFICE Docs 1.1.0 - 2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function
Slug
onlyoffice-docspace
Published
2024-12-11
Title
ONLYOFFICE DocSpace < 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
onlywire-multi-autosubmitter
Published
2024-12-12
Title
Onlywire Multi Autosubmitter <= 1.2.4 - Cross-Site Request Forgery to Cross-Site Scripting
Slug
onoffice-for-wp-websites
Published
2025-04-04
Title
onOffice for WP-Websites < 6.5.1 - Authenticated (Administrator+) SQL Injection
Slug
onoffice-for-wp-websites
Published
2025-06-05
Title
onOffice for WP-Websites < 6.10 - Missing Authorization
Slug
onoffice-for-wp-websites
Published
2025-10-14
Title
onOffice for WP-Websites < 6.10 - Authenticated (Editor+) SQL Injection
Slug
onpay-io-for-woocommerce
Published
2025-11-29
Title
OnPay.io for WooCommerce < 1.0.48 - Missing Authorization
Slug
onwebchat
Published
2020-10-14
Title
Live Chat - Live support < 3.2.0 - Cross-Site Request Forgery
Slug
ooohboi-steroids-for-elementor
Published
2023-02-28
Title
OoohBoi Steroids for Elementor < 2.1.5 - Subscriber+ Attachment Deletion
Slug
ooohboi-steroids-for-elementor
Published
2023-04-18
Title
OoohBoi Steroids for Elementor < 2.1.5 - Arbitrary File Upload
Slug
ooohboi-steroids-for-elementor
Published
2026-03-04
Title
OoohBoi Steroids for Elementor < 2.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple URL Controls
Slug
ooorl
Published
2014-04-25
Title
Ooorl <= 1.0.0 - XSS
Slug
oopspam-anti-spam
Published
2023-01-17
Title
OOPSpam Anti-Spam < 1.1.36 - Admin+ Stored XSS
Slug
oopspam-anti-spam
Published
2023-06-23
Title
OOPSpam Anti-Spam < 1.1.45 - Cross-Site Request Forgery
Slug
oopspam-anti-spam
Published
2025-10-30
Title
OOPSpam Anti-Spam < 1.2.54 - Unauthenticated IP Header Spoofing
Slug
oopspam-anti-spam
Published
2026-03-23
Title
OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) < 1.2.63 - Unauthenticated Stored Cross-Site Scripting