WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
pdf24-posts-to-pdf
Published
2022-05-30
Title
PDF24 Articles To PDF <= 4.2.2 - Arbitrary Settings Update via CSRF
Slug
pdf2post
Published
2025-04-15
Title
PDF 2 Post <= 2.4.0 - Authenticated (Subscriber+) Remote Code Execution
Slug
pdfdraft
Published
2026-07-27
Title
PDFDraft < 1.1.1 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter
Slug
pdfjs-shortcode
Published
2025-01-16
Title
PDF.js Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
pdfjs-viewer-shortcode
Published
2021-11-08
Title
PDF.js Viewer < 2.0.2 - Contributor+ Stored Cross-Site Scripting
Slug
pdfjs-viewer-shortcode
Published
2023-01-10
Title
PDF.js Viewer < 2.1.8 - Contributor+ Stored XSS via Shortcode
Slug
pdfjs-viewer-shortcode
Published
2024-05-20
Title
PDF.js < 4.2.67 - Arbitrary JavaScript Execution
Slug
pdfl-io
Published
2026-04-07
Title
pdfl.io < 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute
Slug
pdpa-consent
Published
2025-06-19
Title
PDPA Consent for Thailand <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
pdpa-thailand
Published
2025-09-22
Title
Designil PDPA Thailand < 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
pdq-csv
Published
2023-07-17
Title
PDQ CSV < 2.0.0 - Admin+ Stored Cross-Site Scripting
Slug
pdw-file-browser
Published
2014-08-01
Title
SWFUpload - Cross-Site Scripting (XSS)
Slug
pdw-file-browser
Published
2014-08-01
Title
PDW File Browser - upload.php Arbitrary File Upload
Slug
pe-easy-slider
Published
2025-09-26
Title
PE Easy Slider <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Slug
peacefulqode-elementzplus-widgets
Published
2026-03-20
Title
PQ Addons – Creative Elementor Widgets <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Attributes
Slug
peachpay-for-woocommerce
Published
2024-11-22
Title
Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net < 1.113.0 - Reflected Cross-Site Scripting
Slug
peachpay-for-woocommerce
Published
2025-09-09
Title
Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net < 1.117.6 - Authenticated (Contributor+) SQL Injection via order_by Parameter
Slug
peachpay-for-woocommerce
Published
2025-09-03
Title
PeachPay Payments < 1.117.5 - Missing Authorization
Slug
peachpay-for-woocommerce
Published
2026-01-19
Title
PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) < 1.119.9 - Missing Authorization to Unauthenticated Order Status Modification
Slug
peachpay-for-woocommerce
Published
2026-05-27
Title
PeachPay < 1.120.47 - Cross-Site Request Forgery to Stripe Unlink
Slug
peachpay-for-woocommerce
Published
2026-10-15
Title
PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check
Slug
pearl-header-builder
Published
2023-04-19
Title
Pearl < 1.3.5 - CSRF
Slug
pearl-header-builder
Published
2024-04-30
Title
WordPress Header Builder Plugin – Pearl < 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
pearl-header-builder
Published
2024-06-11
Title
WordPress Header Builder Plugin – Pearl < 1.3.8 - Missing Authorization to Unauthenticated Arbitrary Site Options Deletion
Slug
pearl-header-builder
Published
2025-01-08
Title
Wordpress Header Builder Plugin < 1.3.9 - Cross-Site Request Forgery to Header Deletion