WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
publishpress
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
publishpress-authors
Published
2024-10-16
Title
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors < 4.7.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover
Slug
publishpress-authors
Published
2025-03-03
Title
PublishPress Authors < 4.7.4 - Authenticated (Administrator+) SQL Injection
Slug
publishpress-authors
Published
2025-05-07
Title
PublishPress Authors < 4.7.6 - Authenticated (Contributor+) Local File Inclusion
Slug
publishpress-authors
Published
2026-03-17
Title
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors < 4.11.0 - Missing Authorization
Slug
publishpress-authors
Published
2026-02-06
Title
PublishPress Authors < 4.11.0 - Missing Authorization
Slug
publishpress-authors
Published
2026-09-14
Title
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors < 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter
Slug
publishpress-authors
Published
2026-10-30
Title
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors < 4.18.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term name
Slug
publishpress-authors
Published
2026-10-29
Title
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors < 4.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
publitio
Published
2025-04-01
Title
Publitio < 2.1.9 - Missing Authorization
Slug
publitio
Published
2025-04-03
Title
Publitio < 2.2.2 - Contributor+ Arbitrary File Read
Slug
publitio
Published
2025-04-01
Title
Publitio < 2.1.9 - Missing Authorization
Slug
publitio
Published
2025-09-22
Title
Publitio < 2.2.2 - Authenticated (Contributor+) Server-Side Request Forgery
Slug
publitio
Published
2025-10-10
Title
Publitio <= 2.2.3 - Authenticated (Contributor+) Information Exposure
Slug
pubsubhubbub
Published
2024-01-24
Title
WebSub (FKA. PubSubHubbub) < 3.2.0 - Admin+ Stored XSS
Slug
pubydoc-data-tables-and-charts
Published
2023-10-27
Title
PubyDoc <= 2.0.6 - Admin+ Stored XSS
Slug
pull-this
Published
2024-11-08
Title
Pull This <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
pullquote
Published
2026-01-08
Title
PullQuote <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
punnel-landing-page-builder
Published
2026-03-20
Title
Punnel <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update via 'punnel_save_config' AJAX Action
Slug
puppyfw
Published
2026-09-15
Title
PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation
Slug
purchase-and-expense-manager
Published
2025-12-11
Title
Purchase and Expense Manager <= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletion
Slug
purchase-button
Published
2026-03-06
Title
Purchase Button For Affiliate Link <= 1.0.2 - Cross-Site Request Forgery to Settings Update
Slug
pure-chat
Published
2024-05-08
Title
Pure Chat – Live Chat Plugin & More! <= 2.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
pure-chat
Published
2024-06-05
Title
Pure Chat – Live Chat Plugin & More! < 2.23 - Cross-Site Request Forgery
Slug
pure-chat
Published
2025-02-18
Title
Pure Chat – Live Chat & More! < 2.41 - Reflected Cross-Site Scripting via purechatWidgetName Parameter